What problem does it solve? Web apps built on Supabase or similar stacks often ship with broken Row Level Security, client-modifiable subscription fields, single-layer rate limits, and no budget caps—leading to data leaks, privilege escalation, and runaway API costs. This Skill runs a structured adversarial audit across these four pillars before deployment. ## Core Features & Use Cases - RLS Adversarial Testing: Five SQL tests (cross-user SELECT/UPDATE, privilege escalation, anon access, policy coverage scan) that must all fail when RLS is correctly configured, plus a regression test template for CI. - Subscription State Protection: Verifies sensitive fields (role, plan, credits) are blocked from client updates and webhooks enforce signature verification, idempotency keys, and timestamp windows. - Dual-Layer Rate Limiting & Budget Caps: Checks user_id + IP rate limits at edge and app layers, tiered quotas, and three-tier budget defense (provider hard cap, app Redis counters, user quotas with HTTP 402). - Use Case: Before launching a new paid LLM feature, run the audit to confirm users cannot self-upgrade to admin, webhooks reject forged signatures, and monthly OpenAI spend is hard-capped. ## Quick Start Ask the agent to run a security audit of your Supabase app covering RLS policies, subscription tampering, rate limits, and budget caps.
