supabase-audit-functions
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
By yoanbernabeu · 448 installs
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-functions
Source repository · Upstream listing
Edge Functions Audit
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO , not just at the end.
Write to .sb pentest context.json IMMEDIATELY after each function tested
Log to .sb pentest audit.log BEFORE and AFTER each function test
DO NOT wait until the skill completes to update files
If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill discovers and tests Supabase Edge Functions for security issues.
When to Use This Skill
To discover exposed Edge Functions
To test function authentication requirements
To check for input validation issues
As part of comprehensive security audit
Prerequisites
Supabase URL available
Detection completed
Understanding Edge Functions
Supabase Edge Functions are Deno based serverless functions:
Security Aspect Consideration
Authentication Functions can require JWT or be public
CORS Cross origin access control
Input Validation User input handling
Secrets Environment variable exposure
Tests Performed
Test Purpose
Function discovery Find exposed functions
Auth requirements Check if JWT required
Input validation Test for injection
Error handling Check for information disclosure
Usage
Basic Function Audit
Test Specific Function
Output Format
json
{"message": "Hello, World!"}
bash
As user A, request user B's data
curl https://abc123def.supabase.co/functions/v1/get user data?user id=user b id \
H "Authorization: Bearer [user a token]"
Returns user B's data!
typescript
// In Edge Function
const { user id } = await req.json();
const jwt user = getUser(req); // From JWT
// Verify ownership
if (user id !== jwt user.id) {
return new Response('Forbidden', { status: 403 });
}
typescript
// Verify admin role
const user = getUser(req);
const { data: profile } = await supabase
.from('profiles')
.select('is admin')
.eq('id', user.id)
.single();
if (!profile?.is admin) {
return new Response('Forbidden', { status: 403 });
}
json
{
"error": "Invalid signature",
"expected": "sha256=abc123...",
"received": "sha256=xyz789..."
}
typescript
// Generic error, log details server side
if (!validSignature) {
console.error( Invalid signature: expected ${expected}, got ${received} );
return new Response('Unauthorized', { status: 401 });
}
Common Function Vulnerabilities
Vulnerability Description Severity
No auth Function accessible without JWT P0 P2
IDOR User can access other users' data P0
Missing role check Regular user accesses admin functions P0
Input injection User input not validated P0 P1
Info disclosure Errors reveal internal details P1 P2
CORS misconfigured Accessible from unintended origins P1 P2
Function Discovery Methods
1. Client Code Analysis
2. Common Name Enumeration
Tested function names:
hello world, hello, test
process payment, payment, checkout
get user data, user, profile
admin, admin panel, dashboard
webhook, webhook handler, stripe webhook
send email, notify, notification
3. Error Response Analysis
Context Output
Secure Function Patterns
Authentication Check
Authorization Check (IDOR Prevention)
Role Check (Admin)
Input Validation
MANDATORY: Progressive Context File Updates
⚠️ This skill MUST update tracking files PROGRESSIVELY during execution, NOT just at the end.
Critical Rule: Write As You Go
DO NOT batch all writes at the end. Instead:
1. Before testing each function → Log the action to .sb pentest audit.log
2. After each vulnerability found → Immediately update .sb pentest context.json
3. After each function test completes → Log the result immediately
This ensures that if the skill is interrupted, crashes, or times out, all findings up to that point are preserved.
Required Actions (Progressive)
1. Update .sb pentest context.json with results:
2. Log to .sb pentest audit.log :
3. If files don't exist , create them before writing.
FAILURE TO UPDATE CONTEXT FILES IS NOT ACCEPTABLE.
MANDATORY: Evidence Collection
📁 Evidence Directory: .sb pentest evidence/07 functions audit/
Evidence Files to Create
File Content
discovered functions.json List of discovered Edge Functions
function tests/[name].json Test results per function
Evidence Format (IDOR Vulnerability)
Evidence Format (Privilege Escalation)
Related Skills
supabase audit rpc — Database functions (different from Edge Functions)
supabase audit auth config — Auth configuration
supabase report — Include in final report