supabase-audit-auth-users

Test Supabase signup, login, recovery, and OTP flows for user enumeration vulnerabilities.

62|3|Updated Jan 31, 2026

Search Tags:#authentication #security audit #supabase #OTP #user enumeration #timing attack

Ready to run

npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-users

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supabase-audit-auth-users
Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/main/skills/audit-auth/supabase-audit-auth-users
Command: npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-users

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security auditors identify and quantify user enumeration vulnerabilities in Supabase authentication flows. By testing signup, login, recovery, and OTP endpoints, it reveals where account existence information leaks through messages, timing, or codes, enabling focused remediation.

Core Features & Use Cases

Timing-based enumeration: Detects differences in response time between existing and non-existing users during login and OTP requests.
Explicit messages analysis: Evaluates error texts during signup and OTP validation to identify direct existence disclosure.
Progressive auditing: Logs findings, timings, and evidence progressively to support traceable security reviews and reporting.

Quick Start

Install the skill and run it against your Supabase project authentication endpoints. The skill will incrementally log context updates and populate the evidence directory as it discovers findings.

Frequently Asked Questions about supabase-audit-auth-users

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect user enumeration vulnerabilities in Supabase authentication?▼

You can detect user enumeration in Supabase auth by testing signup, login, recovery, and OTP endpoints to see if response messages or timing differences leak account existence, producing a clear vulnerability status report.

What is a timing attack in OTP and login flows?▼

A timing attack in OTP and login flows exploits measurable differences in server response times between existing and non-existing users. Analyzing response times during authentication requests identifies if account existence is leaking through processing delays.

How do I audit Supabase signup and OTP endpoints for account existence leaks?▼

Audit Supabase signup and OTP endpoints by evaluating explicit error messages and response timing during validation requests. This process identifies direct existence disclosure and logs findings progressively to evidence files for traceable security reporting.

Can I integrate Supabase authentication security audits into CI pipelines?▼

Yes, you can integrate Supabase authentication security audits into CI pipelines. The audit process produces structured results and progressive context logs suitable for CI integration, enabling automated checks for user enumeration vulnerabilities across auth endpoints.

Does Supabase auth user enumeration testing require external dependencies?▼

Supabase auth user enumeration testing requires no external dependencies. The skill operates independently to test authentication endpoints, quantify vulnerabilities, and log evidence without needing additional components or libraries.