supabase-audit-realtime

Audit Supabase Realtime channels for access control enforcement.

62|3|Updated Jan 31, 2026

Search Tags:#rls #audit #supabase #realtime #websocket #data-exposure

Ready to run

npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-realtime

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supabase-audit-realtime
Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/main/skills/audit-realtime/supabase-audit-realtime
Command: npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-realtime

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams verify that Supabase Realtime channels enforce access controls and do not leak unauthorized data via WebSocket streams.

Core Features & Use Cases

Realtime channel testing: Validate authentication and authorization for Pub/Sub, presence, and table streaming.
Exposure detection: Identify unintended data exposure in subscribed channels and presence data.
Use Case: Run this skill against a Supabase project to confirm that only authorized users receive real-time updates.

Quick Start

Configure your project URL and anon key.
Run the audit to test channels and examine results, including any data exposures.
Review evidence artifacts and included context updates for progressive tracking.

Frequently Asked Questions about supabase-audit-realtime

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Supabase Realtime channels for data exposure?▼

To audit Supabase Realtime channels for data exposure, configure your project URL and anon key to test channel subscriptions, presence, and table streaming for unauthorized data leaks via WebSocket streams.

Can Supabase Realtime bypass Row Level Security (RLS) policies?▼

Supabase Realtime channels can potentially bypass Row Level Security (RLS) policies if not configured correctly, allowing unauthorized data streaming. Auditing Realtime channels verifies that access controls enforce authentication and prevent data exposure.

How do I test Supabase Realtime presence and table streaming security?▼

You can test Supabase Realtime presence and table streaming security by running an audit that validates authentication and authorization for Pub/Sub streams. This process examines subscribed channels to identify unintended data exposure in real-time updates.

What do I need to verify Supabase WebSocket access controls?▼

To verify Supabase WebSocket access controls, you need your Supabase project URL and anon key. Running the audit provides structured results, progressive context updates, and evidence artifacts tracking channel subscription security.

Does this audit detect unauthorized users receiving real-time updates in Supabase?▼

Yes, this audit detects unauthorized users receiving real-time updates in Supabase by validating that only authorized users receive data streams. It identifies exposure across channel subscriptions, presence data, and table changes.

What are the limitations of auditing Supabase Realtime for sensitive data?▼

Auditing Supabase Realtime for sensitive data requires a valid Supabase URL and anon key. It specifically targets WebSocket streams, channel subscriptions, and presence data, meaning standard REST API endpoint vulnerabilities are not covered by this scope.