supabase-security

To audit a Supabase project for RLS leaks, run the provided audit script with your access token and project reference. The Skill scans for exposed functions and public buckets, generating an HTML report and remediation SQL.

Active probing uses the Supabase anon key to actively query your project and confirm RLS leaks, providing concrete evidence of exposed data. This verifies vulnerabilities instead of just statically guessing potential misconfigurations.

Yes, you can integrate this Skill into CI workflows to automatically run security checks. This ensures your Supabase project is continuously audited for RLS leaks, exposed functions, and public buckets during development.

The best way to generate remediation SQL for exposed Supabase functions and public buckets is to run an automated security audit. This Skill identifies the vulnerabilities and outputs the exact SQL statements needed to harden your project.

Yes, you need a Supabase access token to authenticate the audit script. You must provide this token alongside your project reference so the Skill can securely access your Postgres database and evaluate its security posture.

Your Supabase database might expose data due to RLS leaks from exposed functions or misconfigured policies. Running an active security audit probes your setup with the anon key to pinpoint exactly where the leaks occur and generates fixing SQL.