supabase-security

사용 방법

설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.

npx skills add https://github.com/perufitlife/supabase-security-skill --skill supabase-security

시작 전 확인

설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.

원본 Skill 문서

원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.

Supabase Security Skill

A pure-Node.js audit + remediation toolkit for Supabase projects. No dependencies, runs locally, your token never leaves your machine.

What it checks

Tables with RLS disabled + grants to anon/authenticated → critical leak
Tables with RLS enabled but zero policies AND direct anon grants → defense-in-depth issue
SECURITY DEFINER functions executable by anon → privilege escalation surface
Default privileges still grant CRUD on future tables → Supabase enforces revoke by Oct 30, 2026
Public storage buckets → asset leakage
Auth signups with autoconfirm enabled → signup abuse risk

Each finding includes the exact SQL needed to fix it. The skill never applies fixes automatically — it generates, you review, you run.

How to use

Quick audit (JSON to stdout)

bash

SUPABASE_ACCESS_TOKEN=sbp_xxx \
  node scripts/audit.js <project-ref>

HTML report (recommended for sharing)

bash

SUPABASE_ACCESS_TOKEN=sbp_xxx \
  node scripts/audit.js <project-ref> --html report.html

Open report.html in any browser. Self-contained (~25KB), Tailwind + Chart.js via CDN, copy-to-clipboard buttons on every fix.

Get a token

https://supabase.com/dashboard/account/tokens → New token. Read-only is enough for the audit; remediation needs no extra scope (you run the SQL yourself).

Remediation flow

Run the audit, get the HTML report.
Review each finding. Don't blindly apply fixes. Some "high" findings (e.g. is_admin() exposed to anon) are intentional API endpoints.
Click "Copy all SQL" at the bottom and paste into Dashboard → SQL Editor.
Run inside a transaction: BEGIN; ... ROLLBACK; first to verify, then BEGIN; ... COMMIT;.

Scope and limits

Read-only by default. No fix is ever applied without you running the SQL.
Cannot revoke `supabase_admin` default privileges via the Management API (Postgres permission limit). The audit reports this and points to the Dashboard toggle (Project Settings → Data API → "Automatically expose new tables" = OFF).
No false-positive suppression for app APIs. A get_dashboard_stats() function intentionally exposed to anon will still appear as a high finding — exposed code paths are the surface area; you decide if intentional.
Storage scan covers buckets only. Per-object RLS is not audited (would require iterating every object).

Why another Supabase scanner?

Most existing tools (SupaExplorer, AuditYourApp, Vibe App Scanner) are SaaS — your project ref + URL go to a third party. This skill runs locally with your own PAT. The only network calls are to api.supabase.com. Audit it: see scripts/audit.js, ~250 lines of plain Node.

License

MIT — see LICENSE.