supabase-rls-review
Review Supabase RLS and Database Grants
Supabase migrations can leave tables exposed or deny intended Data API access. This skill reviews migration history for RLS, policy, function, and grant issues.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Review the Skillstore skill "supabase-rls-review" from https://skillstore.io/skills/edtrackai-supabase-rls-review.md and its manifest at https://skillstore.io/api/skills/edtrackai-supabase-rls-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„supabase-rls-review“ wird verwendet. Illustrative review of a public table without RLS and an unrestricted authenticated write policy.
Erwartetes Ergebnis:
- Two critical findings: R1 identifies missing RLS, and R2 identifies an unrestricted write policy.
- Suggested fixes: enable RLS and scope write access to the authenticated owner.
- Verification gap: policies created in the dashboard were not available for review.
„supabase-rls-review“ wird verwendet. Illustrative review of a new table covered by an earlier blanket grant.
Erwartetes Ergebnis:
- R5 is not reported because an earlier blanket grant covers the table.
- R6 flags the blanket grant and recommends explicit per-table privileges.
- The review does not confirm live database permissions or successful Data API access.
Sicherheitsaudit
SicherAll eight static findings are false positives: seven match Markdown code spans, and one identifies a Supabase changelog citation. The skill requests read-only migration review and explicitly acknowledges incomplete visibility and heuristic results. No evidence found of command execution, data exfiltration, or prompt injection in SKILL.md.
Risikofaktoren
⚙️ Externe Befehle (7)
🌐 Netzwerkzugriff (1)
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/edtrackai-supabase-rls-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/edtrackai-supabase-rls-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
edtrackai. (2026). supabase-rls-review security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1BibTeX-Zitat
@techreport{edtrackai-edtrackai-supabase-rls-review-2026,
author = {edtrackai},
title = {supabase-rls-review security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "supabase-rls-review security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "edtrackai"
date-released: "2026-10-14"
url: "https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1"
identifiers:
- type: other
value: "skillstore:edtrackai-supabase-rls-review:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: MittelWas Sie erstellen können
Review Database Access Before Launch
Check migration history for missing RLS, unrestricted writes, and broad grants before releasing a Supabase application.
Investigate Data API Permission Errors
Review per-table grants and earlier default privileges when new tables produce a 42501 permission error.
Triage Migration Security Findings
Collect file-level evidence, check identifiers, suggested fixes, and verification gaps for database access reviews.
Diese Prompts ausprobieren
Review my Supabase migrations for RLS and grant issues. Keep files unchanged and report findings with severity, check identifiers, locations, and suggested fixes.
Investigate a 42501 error for [table] using the migration history. Check per-table grants, earlier blanket grants, and default privileges. Report uncertainties.
Review [migration scope] for anonymous writes, unrestricted write policies, and ownership checks. Account for later migrations and list access assumptions requiring verification.
Audit all Supabase migrations in filename order against R1 through R6. Separate missing grants from blanket-grant findings and document evidence and verification gaps.
Bewährte Praktiken
- Provide the full migration history so later fixes and earlier grants can be evaluated in order.
- State intended ownership rules and required database roles before assessing policy findings.
- Verify dashboard configuration and live role behavior separately before applying suggested changes.
Vermeiden
- Treating a clean heuristic report as proof that the database is secure.
- Resolving missing-grant findings by granting access to every table.
- Applying ownership-policy suggestions without checking the actual schema and intended access model.