supabase-audit-tables-list

To enumerate exposed Supabase tables, query the PostgREST OpenAPI schema at your project's REST endpoint using a valid anon key. This reveals all publicly exposed tables, their schemas, and basic column information to map the API attack surface.

Supabase data exposure risks visible through the PostgREST OpenAPI schema include all publicly exposed tables and their metadata. Enumerating these schemas reveals potential data exposure points, helping you prioritize high-risk tables for access control reviews.

Yes, you need a valid anon key to list Supabase tables exposed via the REST API. You must also have access to the project's REST endpoint at the https://[project-ref].supabase.co/rest/v1/ URL to authenticate and retrieve the schema metadata.

Yes, you can inventory exposed Supabase schemas across environments. By running the enumeration skill against the REST endpoints of your various Supabase projects, you capture structured metadata to reveal potential data exposure for each specific environment.

Enumerating Supabase API tables before testing Row Level Security policies allows you to map the available attack surfaces first. This structured inventory of table names and schemas guides your RLS testing by helping you prioritize high-risk tables.

The best way to map the API attack surface of a Supabase project is to enumerate all tables exposed through the PostgREST OpenAPI schema. This outputs structured metadata including table names and schemas to guide risk assessment.