Supabase Extract Db String
This is a critical security check that scans your client-side code for exposed PostgreSQL connection strings, which is a P0 vulnerability if found. It looks for full database URLs, leaked environment variables, and partial credential exposure in JavaScript bundles. If it finds a connection string with password in your client code, it means anyone can bypass your API and Row Level Security to connect directly to your database. The skill progressively logs findings to context files as it runs and gives you immediate remediation steps, starting with resetting your database password. Run this as part of any Supabase security audit or before production deployments.
- skills.sh installs
- 499
- GitHub stars
- 75
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-db-string --agent claude-codeInstalls into .claude/skills of the current project.
Files
Database Connection String Detection
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO, not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until the skill completes to update files
- If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill detects if PostgreSQL database connection strings are accidentally exposed in client-side code.
When to Use This Skill
- As part of every security audit
- When reviewing code before production
- When Supabase database access is suspected
Prerequisites
- Target application accessible
- Supabase detection completed (auto-invokes if needed)
Why This Is Critical
Exposed database connection strings allow:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yoanbernabeu/supabase-pentest-skills
- Categories
- Backend & APIs, Security, Git & Pull Requests, Databases
- First seen
- Jun 3, 2026
More from yoanbernabeu/supabase-pentest-skills
All 23- Supabase Audit Buckets List498
- Supabase Audit Buckets Read497
- Supabase Audit Auth Signup495
- Supabase Report Compare491
- Supabase Extract Jwt487
- Supabase Extract Url487
- Supabase Audit Authenticated446
- Supabase Audit Rls1.2K
- Supabase Audit Functions1.1K
- Supabase Pentest725
- Supabase Audit Auth Config576
- Supabase Audit Rpc551
- Supabase Audit Realtime544
- Supabase Help525
- Supabase Report516
- Supabase Audit Tables Read511
- Supabase Audit Buckets Public509
- Supabase Audit Auth Users506
- Supabase Audit Tables List504
- Supabase Extract Anon Key501
- Supabase Detect500
- Supabase Extract Service Key500
Recommended
More Backend & APIs
safe-action-better-authnext-safe-action/skillsUse when adding authentication or authorization to safe actions with Better Auth -- covers betterAuth() middleware setup, typed session context (BetterAuthConte496skills.sh installs
backend-dev-guidelinesdavila7/claude-code-templatesComprehensive backend development guide for Node.js/Express/TypeScript microservices. Use when creating routes, controllers, services, repositories, middleware,492skills.sh installs
database-indexing-strategyaj-geddes/useful-ai-promptsDesign and implement database indexing strategies. Use when creating indexes, choosing index types, or optimizing index performance in PostgreSQL and MySQL.491skills.sh installs
auth0-aspnetcore-apiauth0/agent-skillsUse when protecting ASP.NET Core Web API endpoints with JWT Bearer token validation, scope checks, or DPoP binding. Integrates Auth0.AspNetCore.Authentication.A490skills.sh installsapi-patternsdavila7/claude-code-templatesAPI design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.486skills.sh installs
api-design-principlessecondsky/claude-skillsMaster REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewin479skills.sh installs