supabase-audit-tables-read

Test read access on exposed Supabase tables via REST API queries.

62|3|Updated Jan 31, 2026
One-click install
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-tables-read
Or copy as Structured Prompt for Agentโ–ผ
Please help me install this Agent Skill.
Skill: supabase-audit-tables-read
Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/main/skills/audit-api/supabase-audit-tables-read
Command: npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-audit-tables-read

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams verify data exposure by attempting to read data from exposed Supabase tables and assess the effectiveness of RLS policies.

Core Features & Use Cases

  • Table read testing: Verify which tables are readable with the current anon/public keys.
  • RLS validation: Determine whether Row-Level Security correctly restricts access.
  • Evidence generation: Produce structured results and progressive context logs for audit reporting.
  • Use Case: For a project with public data leaks, identify exactly which tables expose sensitive data and document remediation steps.

Quick Start

Use the supabase-audit-tables-read skill to test data access on your project; run against the exposed tables and review generated context and evidence files.

Frequently Asked Questions about supabase-audit-tables-read

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test if my Supabase RLS policies are actually preventing data exposure?โ–ผ

To test Supabase RLS policies and data exposure, you can execute REST API read queries against exposed tables to verify which data is accessible and validate if Row-Level Security correctly restricts unauthorized access.

How can I check read access on exposed Supabase tables using the REST API?โ–ผ

You can check read access on exposed Supabase tables by performing REST API read queries against rest/v1/[table] endpoints, logging results progressively to verify actual access scenarios across multiple tables.

What is the best way to audit data leaks in Supabase public tables?โ–ผ

The best way to audit data leaks in Supabase public tables is to test read access using current anon or public keys, which identifies exactly which tables expose sensitive data and generates structured evidence for audit reporting.

Can I generate structured audit reports for Supabase Row-Level Security validation?โ–ผ

Yes, you can generate structured audit reports for Supabase Row-Level Security validation by testing table read access, which produces structured context and progressive evidence logs documenting data exposure and remediation requirements.

Does this Supabase table read testing work without specific dependencies or components?โ–ผ

Yes, this Supabase table read testing works without specific dependencies or components, allowing you to directly verify data access and RLS effectiveness using standard REST API queries.

When should I run an audit on my Supabase REST API data exposure?โ–ผ

You should run an audit on your Supabase REST API data exposure during post-listing-table stages to verify actual access scenarios and determine whether RLS policies correctly restrict read access across multiple tables.