HUNT-SUPABASE — Supabase Exploitation

When to Use

• A JS bundle, .env.
• APK reveals a Supabase URL (project.supabase.co) and anon key (eyJ...).

Prerequisites

• Explicit authorization, target boundaries, and rate limits for the target.
• Tooling: curl, python3.
• A writable evidence directory: export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR".
• For any state-changing step (writes, uploads, credential attempts), obtain explicit confirmation immediately before the command.

How to Run