tech-supabase

To audit Supabase Row-Level Security policies, this skill analyzes REST API endpoints, RLS configurations, and authentication settings to detect unauthorized data access vectors. It requires only read-only access to public API endpoints and configuration metadata.

Yes, you can perform a Supabase security audit without the service_role key. This skill identifies security misconfigurations like weak RLS policies and public data access vectors using only the public anon key and public API endpoints.

The best way to detect exposed service_role keys is through a security posture assessment that evaluates Auth settings and storage bucket permissions. This skill identifies critical vulnerabilities like exposed keys to prevent unauthorized data exposure.

No, this Supabase pentest tool does not require administrative access. It performs non-destructive security validation by analyzing public API endpoints and configuration metadata with read-only access, making it safe for active environments.

To check if Supabase storage bucket permissions allow public access, the skill evaluates storage configurations alongside Auth settings and RLS policies. This verifies that your project correctly restricts public access to sensitive user data.

During a security review, you should look for Supabase authentication misconfigurations that enable unauthenticated database access. This skill detects these critical vulnerabilities by analyzing authentication configurations and public API endpoints.