supabase-audit-auth-signup

A Supabase security audit tests user registration for public availability, email validation, rate limiting, and password policy enforcement to identify vulnerabilities and potential abuse vectors. It requires your Supabase URL and anon key to execute.

Common abuse vectors in Supabase user registration include disposable email usage, weak password policies, lack of rate limiting, and information disclosure in responses. Identifying these vulnerabilities helps prevent unauthorized access and bot exploitation.

Supabase does not automatically block disposable emails by default. Running a dedicated signup security audit tests for disposable email blocking alongside email validation and rate limiting to ensure your registration process is not easily exploitable.

Yes, you need your Supabase URL and anon key to test for email enumeration vulnerabilities. These credentials allow the audit script to interact with your authentication endpoints and check for information disclosure in signup responses.

You can check if Supabase signup is publicly open to bots by performing an availability check combined with rate limiting tests. This determines if user registration is unrestricted and vulnerable to automated abuse.