Supabase

Security testing for Supabase applications. Focus on mis-scoped Row Level Security (RLS), unsafe RPCs, leaked service_role keys, lax Storage policies, and Edge Functions trusting headers without binding to issuer/audience/tenant.

Attack Surface

Data Access

• PostgREST: table CRUD, filters, embeddings, RPC (remote functions)
• GraphQL: pg_graphql over Postgres schema with RLS interaction
• Realtime: replication subscriptions, broadcast/presence channels

Storage

• Buckets, objects, signed URLs, public/private policies

Authentication

• Auth (GoTrue): JWTs, cookie/session, magic links, OAuth flows

Server-Side

• Edge Functions (Deno): server-side code calling Supabase with secrets