scan-fase-6

Testing Supabase Realtime WebSockets for data leaks involves auditing channels to detect unauthorized data access and RLS bypasses across postgres_changes, presence, and broadcast streams.

A Supabase Realtime RLS bypass vulnerability is a channel misconfiguration allowing unauthorized data access to postgres_changes, presence, or broadcast streams, bypassing Row Level Security policies.

Enumerating Supabase Realtime channels for security testing requires applying cross-table tests across discovered schema to identify private channel access and detect real-time data leakage.

Supabase Realtime may not enforce RLS on broadcast and presence channels depending on configuration. Testing these streams verifies RLS enforcement and identifies unauthorized access vulnerabilities.

Auditing Supabase postgres_changes subscriptions for unauthorized access requires cross-table realtime testing to verify RLS enforcement and produce structured reports outlining access violations and misconfigurations.