Supabase Audit Realtime

Tests your Supabase Realtime WebSocket channels for security holes by attempting to subscribe to Postgres Changes, Broadcast, and Presence channels with just an anon key. It progressively logs findings as it goes (critical requirement here), checking if table changes stream when they shouldn't, if broadcast channels like "admin" or "notifications" are publicly accessible, and whether presence data exposes user details. The output is thorough, showing exactly what data is leaking with sample JSON payloads. Use this when you're streaming sensitive data over Realtime and want to verify your RLS policies actually apply to WebSocket subscriptions, not just REST queries. The remediation examples are solid, covering both RLS and the less documented realtime.channels authorization policies.

skills.sh installs: 544
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-realtime --agent claude-code

Installs into .claude/skills of the current project.

Files

Realtime Channel Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each channel tested

Log to .sb-pentest-audit.log BEFORE and AFTER each subscription test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill tests Supabase Realtime WebSocket channels for security issues.

When to Use This Skill

To check if Realtime channels are properly secured
To detect unauthorized data streaming
When Realtime is used for sensitive data
As part of comprehensive security audit

Prerequisites

Supabase URL and anon key available
Detection completed

Understanding Supabase Realtime

Supabase Realtime enables:

wss://[project].supabase.co/realtime/v1/websocket

Feature	Description
Postgres Changes	Stream database changes
Broadcast	Pub/sub messaging
Presence	User presence tracking

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Testing & QA, Security, Databases
First seen: Jun 3, 2026