supabase-audit-realtime

Name: supabase-audit-realtime
Availability: InStock
Author: marvinbiss

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

Updated Jan 31, 2026

Search Tags:#security #rls #audit #supabase #realtime #websocket

Ready to run

npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-audit-realtime-marvinbiss

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supabase-audit-realtime
Source: https://github.com/marvinbiss/servicesartisans/tree/main/.cursor/skills/supabase-audit-realtime
Command: npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-audit-realtime-marvinbiss

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities in Supabase Realtime WebSocket channels, preventing unauthorized data exposure and ensuring data privacy.

Core Features & Use Cases

Channel Security Testing: Audits Postgres Changes, Broadcast, and Presence channels for unauthorized access.
Data Exposure Detection: Identifies if sensitive data is being streamed without proper RLS or authentication.
Use Case: You've implemented Realtime for user notifications. This Skill verifies that only the intended user can subscribe to their own notifications, not all users' notifications.

Quick Start

Audit Realtime channels on my Supabase project.

Frequently Asked Questions about supabase-audit-realtime

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test Supabase Realtime channels for data exposure vulnerabilities?▼

To test Supabase Realtime channels for data exposure, you can audit WebSocket connections against RLS policies. This process scans Postgres Changes, Broadcast, and Presence channels to identify unauthorized subscriptions streaming sensitive data.

Does Supabase Realtime enforce Row Level Security automatically on Postgres Changes?▼

Supabase Realtime does not automatically enforce Row Level Security without proper configuration. Auditing WebSocket channels verifies whether RLS policies and authentication requirements are correctly applied to prevent unauthorized data access.

How do I audit Supabase WebSocket channels for unauthorized subscriptions?▼

You can audit Supabase WebSocket channels for unauthorized subscriptions by scanning them with your project URL and anon key. This tests Postgres Changes, Broadcast, and Presence channels against active RLS policies and authentication rules.

Can I secure Supabase Broadcast and Presence channels without RLS policies?▼

Securing Supabase Broadcast and Presence channels requires checking authentication requirements alongside RLS. Auditing these WebSocket channels identifies if sensitive data is being streamed without proper access controls or user isolation.

What is needed to scan Supabase Realtime channels for security vulnerabilities?▼

Scanning Supabase Realtime channels for security vulnerabilities requires your Supabase URL and anon key for connection. This allows the audit to test WebSocket channels against your existing RLS policies and authentication setup.

Why are my Supabase Realtime user notifications visible to all users?▼

Supabase Realtime user notifications may be visible to all users due to missing or misconfigured RLS policies on the WebSocket channel. Auditing the channel verifies whether unauthorized subscriptions can access other users' notification streams.