scan-fase-3

Test Supabase Row Level Security across REST and GraphQL channels.

Updated Mar 11, 2026

Search Tags:#testing #security #vulnerability #rls #rest #graphql #supabase

Ready to run

npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-3

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-fase-3
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-3
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-3

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Row Level Security policies can misconfigure access control, leading to unintended data exposure on Supabase-backed apps. This skill provides a structured, repeatable method to validate RLS enforcement across REST and GraphQL interfaces, adapt to discovered schema from FASE 2, and document exposure vectors for remediation.

Core Features & Use Cases

Tests RLS policies across common user tables using REST and GraphQL to detect data exposure.
Applies filter bypass, GraphQL bypass, and relationship traversal techniques to uncover weaknesses in policy coverage.
Produces structured results detailing tested tables, vulnerabilities found, and recommended mitigations for security teams.

Quick Start

Invoke with /scan-fase-3 {url} to begin RLS testing against the target application.

Frequently Asked Questions about scan-fase-3

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test Supabase Row Level Security vulnerabilities across REST and GraphQL?▼

Testing Supabase RLS exposures involves validating policy enforcement across REST and GraphQL interfaces using filter bypass, GraphQL bypass, and relationship traversal techniques to uncover misconfigured access control and document data exposure vectors.

What is a Row Level Security exposure in Supabase applications?▼

A Row Level Security exposure in Supabase occurs when misconfigured RLS policies allow unintended data access across REST and GraphQL interfaces. It is detected by exhaustively testing filter bypass, relationship traversal, and real-time channel vectors.

How to check for RLS filter bypass and GraphQL bypass in Supabase?▼

To check for RLS filter bypass and GraphQL bypass in Supabase, evaluate all discovered tables by applying adaptive testing techniques across REST and GraphQL interfaces to validate policy coverage and reveal data exposure vectors.

Does this RLS testing method work with schemas discovered in previous phases?▼

Yes, this RLS testing method adapts to schemas discovered in FASE 2. It evaluates all discovered tables within those schemas by applying cross-method coverage across REST, GraphQL, and real-time channels to validate data exposure vectors.

What is the best way to document Supabase RLS vulnerabilities for security teams?▼

The best way to document Supabase RLS vulnerabilities is producing structured results detailing tested tables, vulnerabilities found, and recommended mitigations. This structured output provides security teams with actionable data for remediation.

Why does my Supabase RLS policy still expose data through relationship traversal?▼

Your Supabase RLS policy may expose data through relationship traversal due to incomplete policy coverage. Applying relationship traversal techniques across REST and GraphQL interfaces reveals these unintended data exposure vectors for targeted remediation.