Supabase Audit Authenticated

Creates a test user in your Supabase project to compare what authenticated users can access versus anonymous ones, specifically hunting for IDOR vulnerabilities and cross-user data leaks. You'd run this after your anonymous audit to catch the stuff that only shows up when you're logged in: someone accessing another user's orders, reading all profiles when they should only see their own, or hitting admin endpoints with a regular account. The skill is paranoid about progressive logging, writing findings to disk after each test so you don't lose evidence if something crashes. Asks for explicit consent before creating the pentest user and offers to delete it when done.

skills.sh installs: 446
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-authenticated --agent claude-code

Installs into .claude/skills of the current project.

Files

Authenticated User Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each test

Log to .sb-pentest-audit.log BEFORE and AFTER each action

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.