supabase-audit-realtime

To audit Supabase Realtime channels for data exposure, configure your project URL and anon key to test channel subscriptions, presence, and table streaming for unauthorized data leaks via WebSocket streams.

Supabase Realtime channels can potentially bypass Row Level Security (RLS) policies if not configured correctly, allowing unauthorized data streaming. Auditing Realtime channels verifies that access controls enforce authentication and prevent data exposure.

You can test Supabase Realtime presence and table streaming security by running an audit that validates authentication and authorization for Pub/Sub streams. This process examines subscribed channels to identify unintended data exposure in real-time updates.

To verify Supabase WebSocket access controls, you need your Supabase project URL and anon key. Running the audit provides structured results, progressive context updates, and evidence artifacts tracking channel subscription security.

Yes, this audit detects unauthorized users receiving real-time updates in Supabase by validating that only authorized users receive data streams. It identifies exposure across channel subscriptions, presence data, and table changes.

Auditing Supabase Realtime for sensitive data requires a valid Supabase URL and anon key. It specifically targets WebSocket streams, channel subscriptions, and presence data, meaning standard REST API endpoint vulnerabilities are not covered by this scope.