skills.rest
yoanbernabeu
yoanbernabeuCOMMUNITY
Explore all skills by this author →
Website𝕏@yOyO38GitHub

supabase-audit-auth-signup

Audit Supabase /auth/v1/signup for security and abuse vectors.

62|3|Updated Jan 31, 2026
Search Tags:#testing#security#supabase#evidence#rate-limiting#auth#signup
One-click install
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-signup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-audit-auth-signup
Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/main/skills/audit-auth/supabase-audit-auth-signup
Command: npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-signup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill verifies whether user signup is exposed and identifies abuse vectors in the registration workflow for Supabase-powered applications.

Core Features & Use Cases

  • Open signup detection and rate limiting assessment
  • Disclosure risks and enumeration of existing accounts
  • Progressive context logging and evidence collection during tests
  • Use Case: Audit a project's /auth/v1/signup to ensure signup is properly protected

Quick Start

Install the skill and run it against your Supabase project. Use the supplied endpoints and your anon key to perform the tests and generate progressive context and evidence files.

Frequently Asked Questions about supabase-audit-auth-signup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Supabase signup endpoints for security vulnerabilities?▼

You can audit Supabase signup endpoints by testing the /auth/v1/signup flow for open registration, rate limiting, password policies, and email enumeration risks to generate structured evidence files documenting all findings.

What security risks should I check for in a Supabase user registration flow?▼

Supabase registration flows should be checked for open signup availability, email validation behavior, rate limiting enforcement, password policy strength, account enumeration disclosure, and signup confirmation handling.

Can I test Supabase auth signup rate limiting without external tools?▼

Yes, you can test Supabase auth rate limiting using standard project credentials and your anon key, requiring no external tools to assess the /auth/v1/signup endpoint across multiple abuse scenarios.

How does email enumeration affect Supabase auth security?▼

Email enumeration risks in Supabase auth occur when the signup endpoint reveals whether an account already exists, allowing attackers to disclose valid user emails during the registration workflow audit.

What evidence does a Supabase signup security audit generate?▼

A Supabase signup audit generates structured evidence files documenting security findings, while progressively logging context updates to .sb-pentest-context.json and .sb-pentest-audit.log during testing.

Related Skills

Explore More Software Engineering Skills→
ictcentervnictcentervn

supabase-step

Migrate local Padlet-style app storage to Supabase cloud database.

Community
Intermediate
yoanbernabeuyoanbernabeu
62

supabase-report

Generate a Markdown security audit report from collected findings.

Community
Advanced
leetdavidleetdavid
1

email-and-password-best-practices

Configure email verification, password reset flows, and password policies with Better Auth.

Community
Advanced
trilwutrilwu
109

testing-apis

Identify and exploit API security weaknesses across REST and GraphQL endpoints.

Community
Advanced