🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

• Write to

  .sb-pentest-audit.log

  IMMEDIATELY as you process each section
• Update

  .sb-pentest-context.json

  with report metadata progressively
• DO NOT wait until the entire report is generated to update files
• If the skill crashes or is interrupted, the partial progress must already be saved

This is not optional. Failure to write progressively is a critical error.

• After completing security audit phases
• To document findings for stakeholders
• To create actionable remediation plans
• For compliance and audit trail purposes

• Audit phases completed (context file populated)
• Findings collected in

  .sb-pentest-context.json

1. Executive Summary — High-level overview for management
2. Security Score — Quantified risk assessment
3. Critical Findings (P0) — Immediate action required
4. High Findings (P1) — Address soon
5. Medium Findings (P2) — Plan to address
6. Detailed Analysis — Per-component breakdown
7. Remediation Plan — Prioritized action items
8. Appendix — Technical details, methodology

1. Service Role Key Exposed — Full database access possible
2. Database Backups Public — All data downloadable
3. Admin Function No Auth — Any user can access admin features

1. ⚡ Immediate (Today):
   • Rotate service role key
   • Make backup bucket private
   • Add admin role verification
2. 🔜 This Week:
   • Enable RLS on all tables
   • Enable email confirmation
   • Fix IDOR in Edge Functions
3. 📅 This Month:
   • Strengthen password policy
   • Restrict CORS origins
   • Add rate limiting to functions

• Full read/write access to all database tables
• Bypass of all RLS policies
• Access to auth.users table (all user data)
• Ability to delete or modify any data

1. Rotate the service role key in Supabase Dashboard
   • Settings → API → Regenerate service_role key
2. Remove the key from client code
3. Redeploy the application

// Move privileged operations to Edge Functions
// supabase/functions/admin-action/index.ts

import { createClient } from '@supabase/supabase-js'

Deno.serve(async (req) => {
  // Service key only on server
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL')!,
    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
  )

  // Verify caller is admin before proceeding
  // ...
})

• Supabase API Keys
• Edge Functions

• Complete data breach (all database content)
• Exposed credentials for third-party services
• User PII exposed (emails, names, etc.)

-- Make bucket private
UPDATE storage.buckets
SET public = false
WHERE name = 'backups';

-- Delete or move files
-- Consider incident response procedures

• Stripe API keys
• Database password
• JWT secret
• Any other keys in secrets.env

• Passive reconnaissance of client-side code
• API endpoint testing with anon and service keys
• Storage bucket enumeration and access testing
• Authentication flow analysis
• Real-time channel subscription testing

• supabase-pentest-skills v1.0.0
• curl for API testing
• Browser DevTools for client code analysis

• Target URL: https://myapp.example.com
• Supabase Project: abc123def
• Components tested: API, Storage, Auth, Realtime, Edge Functions
• Exclusions: None

1. .sb-pentest-context.json

   exists and contains findings from audit skills

2. .sb-pentest-audit.log

   exists with timestamped actions
3. All relevant audit skills have updated these files

1. DO NOT generate an empty report
2. Inform the user that audit skills must be run first
3. Recommend running

   supabase-pentest

   for a complete audit

1. Log to

   .sb-pentest-audit.log

   :

   [TIMESTAMP] [supabase-report] [START] Generating security report
   [TIMESTAMP] [supabase-report] [SUCCESS] Report generated: supabase-audit-report.md
   [TIMESTAMP] [supabase-report] [CONTEXT_UPDATED] Report generation logged

2. Update

   .sb-pentest-context.json

   with report metadata:
   json

   {
     "report": {
       "generated_at": "...",
       "filename": "supabase-audit-report.md",
       "findings_count": { "p0": 3, "p1": 4, "p2": 5 }
     }
   }

• supabase-report-compare

  — Compare with previous reports

• supabase-pentest

  — Run full audit first

• supabase-help

  — List all available skills