Supabase Audit Buckets Public

This audit checks your Supabase storage for publicly accessible buckets and flags anything that shouldn't be world-readable. It's the kind of thing you'd run before a security review or when you realize that "public" bucket from prototyping is still serving files in production. The scan distinguishes between legitimate public assets like avatars and genuinely dangerous stuff like database backups or .env files with exposed URLs anyone can hit. What's smart here is the progressive logging requirement: it writes findings to context files as it goes, so if the scan crashes halfway through a large storage instance, you don't lose everything. The output is thorough, maybe even verbose, but when it finds a publicly accessible secrets.env file, you'll appreciate the detail.

skills.sh installs: 509
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-buckets-public --agent claude-code

Installs into .claude/skills of the current project.

Files

Public Bucket Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each bucket analyzed

Log to .sb-pentest-audit.log BEFORE and AFTER each test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill specifically focuses on identifying misconfigured public buckets and exposed sensitive content.

When to Use This Skill

Quick check for public bucket misconfigurations
When you suspect sensitive data in public storage
As a focused security check for storage
Before deploying to production

Prerequisites

Supabase URL and anon key available

Why Public Buckets Are Risky

Public buckets allow:

Access Type	Description
Direct URL	Anyone with the URL can download
Enumeration	File listing may be possible
No Auth	No authentication required
Caching	CDN may cache sensitive files