supabase-audit-rpc

To audit Supabase RPC functions for SQL injection, the Skill tests text parameters on exposed PostgreSQL functions for injection flaws and identifies functions with inadequate authorization checks. It requires your Supabase URL and anon key to access and assess your project.

RLS bypass in Supabase PostgreSQL functions is often caused by using SECURITY DEFINER without proper authorization checks. The Skill scans exposed RPC functions to identify this configuration and detect inadequate security boundaries that could expose sensitive data.

You can check SECURITY DEFINER functions by auditing all exposed RPC functions for missing authorization checks and potential RLS bypass. The Skill automates this security testing to ensure custom database functions do not inadvertently allow unauthorized actions before deployment.

You do not need database admin credentials to scan Supabase RPC endpoints for security issues. The Skill requires only the Supabase project URL and the anon key to list available functions and test text parameters for injection vulnerabilities.

The best way to discover exposed PostgreSQL functions is to use an automated audit tool that lists all available RPC endpoints. The Skill connects using your Supabase URL and anon key to enumerate functions and assess them for security vulnerabilities.

Your Supabase RPC function likely bypasses row level security policies because it is defined with SECURITY DEFINER or lacks adequate authorization checks. The Skill identifies these specific configurations to help you pinpoint and resolve RLS bypass risks.