Supabase Security Audit

Run a comprehensive Supabase security audit for the project.

Target: $ARGUMENTS (optional — focus area like "rls", "secrets", "routes")

Audit Checklist

1. Exposed Secrets (Critical)

Search the entire codebase for leaked credentials:

SUPABASE_SERVICE_ROLE_KEY
supabase.co (with inline keys)
anon key in client-side code (acceptable only if RLS is enforced)

Check:

• .env files are gitignored
• No secrets in client-side bundles (src/ should only use anon key)
• Server-side code uses service role key only in server/ directory
• No secrets committed in git history

2. Row Level Security (RLS)

If SQL migrations or schema files exist, check:

• All tables have RLS enabled
• Policies exist for SELECT, INSERT, UPDATE, DELETE as appropriate
• No overly permissive policies (USING (true) without justification)
• Auth context is properly used (auth.uid(), auth.role())

3. API Route Security

Audit all Express routes in server/:

• Authentication middleware on protected routes
• Input validation (Zod schemas) on all mutation endpoints
• No direct database access without auth checks
• Rate limiting on sensitive endpoints
• CORS configuration is restrictive

4. Client-Side Security

Check src/ for:

• No direct Supabase client mutations that bypass the API server
• Sensitive operations go through Express API, not direct Supabase calls
• Auth tokens are handled securely (httpOnly cookies preferred over localStorage)

5. Storage Security

If Supabase Storage is used:

• Bucket policies restrict access appropriately
• No public buckets containing sensitive data
• Upload size limits enforced
• File type validation on uploads

6. Environment Configuration

Check:

• .env.local / .env are in .gitignore
• Server and client environment variables are properly separated
• No SUPABASE_SERVICE_ROLE_KEY accessible from client code

Output Format

## Supabase Security Audit

### Critical (exploitable now)
| # | Category | File:Line | Issue | Remediation |
|---|----------|-----------|-------|-------------|

### High (should fix before production)
| # | Category | File:Line | Issue | Remediation |
|---|----------|-----------|-------|-------------|

### Medium (hardening)
| # | Category | File:Line | Issue | Remediation |
|---|----------|-----------|-------|-------------|

### Passed Checks
- ...

Apply Critical fixes automatically. Report High and Medium for user review.