supabase-audit-auth-users

You can detect user enumeration in Supabase auth by testing signup, login, recovery, and OTP endpoints to see if response messages or timing differences leak account existence, producing a clear vulnerability status report.

A timing attack in OTP and login flows exploits measurable differences in server response times between existing and non-existing users. Analyzing response times during authentication requests identifies if account existence is leaking through processing delays.

Audit Supabase signup and OTP endpoints by evaluating explicit error messages and response timing during validation requests. This process identifies direct existence disclosure and logs findings progressively to evidence files for traceable security reporting.

Yes, you can integrate Supabase authentication security audits into CI pipelines. The audit process produces structured results and progressive context logs suitable for CI integration, enabling automated checks for user enumeration vulnerabilities across auth endpoints.

Supabase auth user enumeration testing requires no external dependencies. The skill operates independently to test authentication endpoints, quantify vulnerabilities, and log evidence without needing additional components or libraries.