security-auditor

Audit Supabase RLS policies and GRANT statements for security gaps.

Updated Dec 19, 2025

Search Tags:#security #rls #access control #supabase #grants #database audit

Ready to run

npx skills add https://github.com/Spectaculous-Code/raamattu-nyt --skill security-auditor-spectaculous-code

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/Spectaculous-Code/raamattu-nyt/tree/main/.claude/skills/security-auditor
Command: npx skills add https://github.com/Spectaculous-Code/raamattu-nyt --skill security-auditor-spectaculous-code

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and fix critical security vulnerabilities in your Supabase database by auditing Row Level Security (RLS) policies and table-level GRANTs, ensuring your data is protected.

Core Features & Use Cases

Comprehensive Auditing: Analyzes both RLS policies and GRANT statements to provide a complete picture of database access.
Gap Identification: Pinpoints missing RLS policies for granted privileges and highlights overly permissive configurations.
Use Case: A developer needs to ensure that only authenticated users with specific roles can modify sensitive data in the products table. They can use this Skill to generate an access matrix and verify that RLS policies correctly restrict UPDATE and DELETE operations to authorized administrators, while allowing SELECT for all authenticated users.

Quick Start

Run the security audit script to generate a detailed access matrix for your Supabase database.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Supabase Row Level Security policies and GRANT statements?▼

To audit Supabase Row Level Security policies and GRANT statements, run a security audit script that analyzes PostgreSQL system catalogs to generate a detailed access matrix and pinpoint missing configurations. This process identifies security gaps in your database access controls.

What are common security gaps in Supabase database access control?▼

Common Supabase database access control security gaps include missing RLS policies for granted privileges and overly permissive table configurations. Auditing these GRANT statements helps verify that user data protection and admin access patterns are correctly restricted.

How can I generate an access matrix to verify Supabase admin access patterns?▼

You can generate an access matrix to verify Supabase admin access patterns by auditing RLS policies against table-level GRANTs. This validates whether operations like UPDATE and DELETE are correctly restricted to authorized administrators while allowing SELECT for authenticated users.

Does the Supabase security audit require access to PostgreSQL system catalogs?▼

Yes, the Supabase security audit requires execution within a Supabase environment with direct access to PostgreSQL system catalogs. This access is necessary to analyze and validate RLS policies and table-level GRANT statements comprehensively.

When should I audit RLS policies to identify missing data protection rules?▼

You should audit RLS policies to identify missing data protection rules whenever you grant new table privileges or modify user roles. This ensures that sensitive data remains protected by verifying that every granted privilege has a corresponding restrictive policy.