supabase-audit-rpc

Auditing Supabase RPC functions for RLS bypass involves scanning exposed PostgreSQL functions to verify they respect Row Level Security and authenticated access controls. This process identifies functions where improper definer rights or missing checks allow data exposure.

The risk of using SECURITY DEFINER in PostgreSQL RPC functions is that the function executes with the privileges of its owner rather than the caller, potentially bypassing Row Level Security. Auditing checks for missing auth.uid validations and unsafe dynamic queries in these functions.

To test if your Supabase RPC functions handle input validation and prevent injection, an audit evaluates safe parameter usage and detects unsafe dynamic behavior across your exposed functions. This surfaces critical vulnerabilities and guides remediation.

Yes, this RPC audit checks for proper revocation of anonymous access in Supabase by validating permissions and access control configurations. It ensures exposed PostgreSQL functions enforce authenticated access controls and do not allow unauthorized data retrieval.

To discover all exposed PostgreSQL RPC functions in your Supabase project, you invoke an audit flow on the target project's REST endpoint. The discovery process enumerates all exposed functions and evaluates their security posture.