Supabase RLS Security Auditor
Supabase RLS Security Auditor assesses and audits Supabase apps across RLS, Auth/IAM, data security, APIs, Edge Functions, storage, secrets, third-party integrations, governance, logging, and security operations.
Built for founders, vibe-coded apps, SaaS teams, and builders preparing to launch. Returns prioritized findings, exploit paths, safe SQL/architecture fixes, regression tests, and launch-blocker guidance.
#Ingénierie#Productivité#Analyse
Note
Davantage d’évaluations nécessaires
Vendus
0
Mode d’utilisation
Exécuter sur Capafy
Aussi sur des applications externes
Fourni par l’éditeur
Claude Sonnet 5
#Supabase RLS Security Auditor
A security-focused audit Agent for Supabase-backed apps. It reviews your database schema, RLS policies, Postgres functions, storage rules, Edge Function patterns, secrets boundaries, third-party integrations, logging, and launch governance.
It is designed for founders, vibe coders, solo builders, and engineering teams who need to answer one urgent question:
Is my Supabase app safe to launch?
What this Agent audits
| Area | What it checks |
|---|---|
| RLS policies | Missing RLS, overbroad policies, bad USING / WITH CHECK logic, cross-user and cross-tenant access |
| Supabase Auth / IAM | auth.uid() usage, JWT claims, anonymous access, admin/staff roles, MFA/AAL2 assumptions |
| Tenant isolation | Org/team boundaries, membership tables, owner/admin permissions, invitation flows |
| Postgres functions / RPCs | SECURITY DEFINER, unsafe search_path, exposed RPCs, missing internal auth checks |
| Storage security | Public/private buckets, object path authorization, upload/update/delete access, signed URL risks |
| Edge Functions | Auth enforcement, service-role use, CORS, webhook verification, replay/idempotency issues |
| Data security | PII, private user data, messages, identity data, billing references, moderation/evidence data |
| Exposure management | Anonymous access, public grants, unsafe views, exposed APIs, client-controlled identifiers |
| Third-party integrations | Stripe, RevenueCat, Didit, Sentry, Twilio, email, push, moderation vendors, webhook security |
| Logging and operations | Audit logs, abuse detection, alerting gaps, admin actions, review queues, regression tests |
| Launch governance | Launch blockers, risk severity, remediation priority, owner/accountability guidance |
Best inputs to provide
Paste sanitized versions of any of the following:
- Table schemas
- RLS policies
- SQL migrations
- Postgres functions
- RPC definitions
- Storage bucket policies
- Edge Function route/auth patterns
- Role model and tenant model
- Third-party webhook patterns
- App type and sensitive data types
Do not paste production secrets, service-role keys, JWT signing secrets, private keys, access tokens, or live credentials.
What you get back
The Agent returns a structured audit report with:
- Overall risk rating
- Launch recommendation
- Prioritized findings
- Critical/high/medium/low severity table
- Defensive exploit-path explanations
- Safe SQL or architecture fixes when possible
- Regression test plan
- Missing evidence checklist
- Launch-blocker guidance
Example output sections
# Supabase Security Audit
## Executive Summary
- Overall risk rating:
- Launch recommendation:
- Highest-risk issue:
- Most important fix:
- Confidence level:
- Missing information:
## Findings by Severity
| Severity | Domain | Finding | Why it matters | Evidence | Fix |
|---|---|---|---|---|---|
## Exploit Path Explanation
## Recommended Fixes
## Regression Test Plan
## Follow-Up Questions
