Supabase Audit Auth Config

This audits your Supabase auth settings and flags security gaps you might miss during setup. It checks whether email confirmation is enabled, tests password requirements, identifies enabled OAuth providers, and reviews CORS configuration. You'll want to run this before going to production or if you inherited a project and need to know what's exposed. The real value is in catching the common stuff like open signups with no email verification or six character password minimums. It writes findings progressively to context files so you don't lose results if something crashes mid-audit. Think of it as a security checklist that actually runs the checks instead of just handing you a list.

skills.sh installs: 576
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config --agent claude-code

Installs into .claude/skills of the current project.

Files

Authentication Configuration Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each setting analyzed

Log to .sb-pentest-audit.log BEFORE and AFTER each test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.