Supabase Audit Auth Users

Tests your Supabase auth endpoints for user enumeration vulnerabilities by probing signup, login, password recovery, and OTP flows. It checks both explicit information leakage (different error messages for existing vs. non-existing users) and timing-based leakage (existing users take longer to process because of password hashing or email sending). The output is thorough, showing exact response times, providing proof-of-concept curl commands, and ranking vulnerabilities as P1 or P2. Most valuable during pre-launch security audits or if you're hardening an existing app. The progressive logging approach is smart since enumeration tests can take time and you don't want to lose findings mid-run.

skills.sh installs: 506
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-users --agent claude-code

Installs into .claude/skills of the current project.

Files

User Enumeration Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each endpoint tested

Log to .sb-pentest-audit.log BEFORE and AFTER each test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.