Back to browse
GitHub Repository

Open-source Supabase security auditor: detects RLS-disabled tables, public buckets, exposed SECURITY DEFINER functions. Active anonymous probe confirms each leak with the anon key.

19 starsJavaScript

I audited my own back ends on 5 BaaS – leak in every one

by renzom13·May 10, 2026·4 points·2 comments

AI Analysis

●●SolidSolve My ProblemNiche Gem

Active anon-key probing confirms leaks live instead of just inferring them from config.

Strengths
  • Active probing with the anon key validates findings rather than relying on static config checks.
  • Generates copy-paste SQL fixes for every detected vulnerability to speed up remediation.
  • Runs entirely locally ensuring your access token and audit data never leave your machine.
Weaknesses
  • Limited to Supabase ecosystem while similar risks exist in Firebase, Appwrite, and PocketBase.
  • Requires a personal access token which adds friction compared to read-only public scans.
Category
Target Audience

Supabase developers and security engineers

Similar To

Supabase Studio · pgAudit · Snyk

Similar Projects

Developer Tools●●Solid

Production-Ready NestJS Back End (Multi-Tenancy, Event-Driven)

Concrete, hands-on demos — row-level multi-tenancy implemented with Prisma, async jobs via BullMQ/Redis, and tracing through OpenTelemetry/Jaeger — make this a useful reference for people building SaaS backends. It’s not reinventing the stack, but the repo bundles several production patterns and infra pieces together in a way that’s easy to explore; would be stronger with architecture diagrams, runnable quickstart scripts and example data.

Niche GemShip It
PkLavc
104mo ago