Capafy logo Capafy
Empezar
Supabase RLS Security Auditor

Supabase RLS Security Auditor

by: Tarrell Clark | Cybersecurity
Supabase RLS Security Auditor assesses and audits Supabase apps across RLS, Auth/IAM, data security, APIs, Edge Functions, storage, secrets, third-party integrations, governance, logging, and security operations. Built for founders, vibe-coded apps, SaaS teams, and builders preparing to launch. Returns prioritized findings, exploit paths, safe SQL/architecture fixes, regression tests, and launch-blocker guidance.
#Ingeniería#Productividad#Análisis
Valoración
Se necesitan más valoraciones
Vendidos
0
Cómo se usa
Ejecutar en Capafy
También en aplicaciones externas
Proporcionado por el publisher
Claude Sonnet 5

#Supabase RLS Security Auditor

A security-focused audit Agent for Supabase-backed apps. It reviews your database schema, RLS policies, Postgres functions, storage rules, Edge Function patterns, secrets boundaries, third-party integrations, logging, and launch governance.

It is designed for founders, vibe coders, solo builders, and engineering teams who need to answer one urgent question:

Is my Supabase app safe to launch?

What this Agent audits

Area What it checks
RLS policies Missing RLS, overbroad policies, bad USING / WITH CHECK logic, cross-user and cross-tenant access
Supabase Auth / IAM auth.uid() usage, JWT claims, anonymous access, admin/staff roles, MFA/AAL2 assumptions
Tenant isolation Org/team boundaries, membership tables, owner/admin permissions, invitation flows
Postgres functions / RPCs SECURITY DEFINER, unsafe search_path, exposed RPCs, missing internal auth checks
Storage security Public/private buckets, object path authorization, upload/update/delete access, signed URL risks
Edge Functions Auth enforcement, service-role use, CORS, webhook verification, replay/idempotency issues
Data security PII, private user data, messages, identity data, billing references, moderation/evidence data
Exposure management Anonymous access, public grants, unsafe views, exposed APIs, client-controlled identifiers
Third-party integrations Stripe, RevenueCat, Didit, Sentry, Twilio, email, push, moderation vendors, webhook security
Logging and operations Audit logs, abuse detection, alerting gaps, admin actions, review queues, regression tests
Launch governance Launch blockers, risk severity, remediation priority, owner/accountability guidance

Best inputs to provide

Paste sanitized versions of any of the following:

  • Table schemas
  • RLS policies
  • SQL migrations
  • Postgres functions
  • RPC definitions
  • Storage bucket policies
  • Edge Function route/auth patterns
  • Role model and tenant model
  • Third-party webhook patterns
  • App type and sensitive data types

Do not paste production secrets, service-role keys, JWT signing secrets, private keys, access tokens, or live credentials.

What you get back

The Agent returns a structured audit report with:

  • Overall risk rating
  • Launch recommendation
  • Prioritized findings
  • Critical/high/medium/low severity table
  • Defensive exploit-path explanations
  • Safe SQL or architecture fixes when possible
  • Regression test plan
  • Missing evidence checklist
  • Launch-blocker guidance

Example output sections

# Supabase Security Audit

## Executive Summary
- Overall risk rating:
- Launch recommendation:
- Highest-risk issue:
- Most important fix:
- Confidence level:
- Missing information:

## Findings by Severity

| Severity | Domain | Finding | Why it matters | Evidence | Fix |
|---|---|---|---|---|---|

## Exploit Path Explanation

## Recommended Fixes

## Regression Test Plan

## Follow-Up Questions

View more