skills.rest
marvinbiss
marvinbissCOMMUNITY
Explore all skills by this author →
GitHub

supabase-extract-db-string

Detect exposed PostgreSQL connection strings in JavaScript bundles.

Updated Jan 31, 2026
Search Tags:#security#vulnerability#database#supabase#exposure#connection string#p0
One-click install
npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-db-string-marvinbiss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-extract-db-string
Source: https://github.com/marvinbiss/servicesartisans/tree/main/.cursor/skills/supabase-extract-db-string
Command: npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-db-string-marvinbiss

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and alerts on accidentally exposed PostgreSQL database connection strings within client-side code, which is a critical security vulnerability.

Core Features & Use Cases

  • Vulnerability Detection: Scans client-side code for patterns matching Supabase or generic PostgreSQL connection strings, including passwords.
  • Critical Alerting: Immediately flags exposed credentials as a P0 (Critical) finding, providing detailed impact and remediation steps.
  • Use Case: During a security audit, this skill automatically scans the application's JavaScript bundles to ensure no database credentials are inadvertently leaked to the client, preventing direct database access by attackers.

Quick Start

Scan the application at https://myapp.example.com for any exposed database connection strings.

Frequently Asked Questions about supabase-extract-db-string

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect exposed Supabase database connection strings in my JavaScript bundles?▼

To detect exposed Supabase database connection strings, scan your application's client-side JavaScript bundles for hardcoded PostgreSQL credentials and environmental variable leaks. This prevents attackers from bypassing Row Level Security and gaining direct database access.

What happens when a PostgreSQL connection string with a password is leaked in client-side code?▼

When a PostgreSQL connection string is leaked in client-side code, it creates a critical P0 security vulnerability. Attackers can extract the credentials to establish direct database access, completely bypassing application-level security controls like Row Level Security (RLS).

How do I scan my web application for leaked database credentials during a security audit?▼

You can scan a web application for leaked database credentials by analyzing the deployed JavaScript bundles and environment variable configurations. This scan specifically targets Supabase connection string patterns to identify accidental credential exposure.

Does this detection method work for generic PostgreSQL connection strings or only Supabase patterns?▼

This detection works for both generic and Supabase-specific PostgreSQL connection string patterns. It thoroughly analyzes client-side code and environmental variable configurations to identify any exposed database passwords.

Why are exposed database connection strings considered a P0 critical security finding?▼

Exposed database connection strings are considered a P0 critical finding because they contain embedded passwords that allow immediate, direct database access. This exposure completely circumvents application security layers, leading to severe data breaches.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-js-analysis

Extract API endpoints, routing tables, and environment configurations from client-side JavaScript bundles.

Community
Advanced
IgorWarzochaIgorWarzocha
124

security-vite

Audit Vite applications for exposed secrets and insecure configurations.

Community
Intermediate
PlaneInABottlePlaneInABottle

supabase

Integrate Supabase authentication, database, storage, and realtime services.

Community
Intermediate
zhangzhang-111-izhangzhang-111-i
2

env-secrets-manager

Scan repositories for environment variable and secret leaks.

Community
Intermediate