supabase-audit-realtime

To test Supabase Realtime channels for data exposure, you can audit WebSocket connections against RLS policies. This process scans Postgres Changes, Broadcast, and Presence channels to identify unauthorized subscriptions streaming sensitive data.

Supabase Realtime does not automatically enforce Row Level Security without proper configuration. Auditing WebSocket channels verifies whether RLS policies and authentication requirements are correctly applied to prevent unauthorized data access.

You can audit Supabase WebSocket channels for unauthorized subscriptions by scanning them with your project URL and anon key. This tests Postgres Changes, Broadcast, and Presence channels against active RLS policies and authentication rules.

Securing Supabase Broadcast and Presence channels requires checking authentication requirements alongside RLS. Auditing these WebSocket channels identifies if sensitive data is being streamed without proper access controls or user isolation.

Scanning Supabase Realtime channels for security vulnerabilities requires your Supabase URL and anon key for connection. This allows the audit to test WebSocket channels against your existing RLS policies and authentication setup.

Supabase Realtime user notifications may be visible to all users due to missing or misconfigured RLS policies on the WebSocket channel. Auditing the channel verifies whether unauthorized subscriptions can access other users' notification streams.