Supabase Security Skill

A pure-Node.js audit + remediation toolkit for Supabase projects. No dependencies, runs locally, your token never leaves your machine.

What it checks

1. Tables with RLS disabled + grants to anon/authenticated → critical leak
2. Tables with RLS enabled but zero policies AND direct anon grants → defense-in-depth issue
3. SECURITY DEFINER functions executable by anon → privilege escalation surface
4. Default privileges still grant CRUD on future tables → Supabase enforces revoke by Oct 30, 2026
5. Public storage buckets → asset leakage
6. Auth signups with autoconfirm enabled → signup abuse risk

Each finding includes the exact SQL needed to fix it. The skill never applies fixes automatically — it generates, you review, you run.

How to use

Quick audit (JSON to stdout)