supabase-security-audit — Claude Code command: Supabase audit
A slash command that audits a Supabase project: RLS policies, role permissions, API keys and auth configuration, with a report at the end.
npx claude-code-templates@latest --command database/supabase-security-auditWhat supabase-security-audit does
The command runs a security pass over whichever area you name. Pick one — Row Level Security policies, permissions, auth, API keys — or run the whole thing. The scope goes in as an argument: --rls, --permissions, --auth, --api-keys, --comprehensive.
Six steps sit behind it: reviewing RLS policies and hunting for gaps, checking table and role permissions for over-privileged access, inspecting auth configuration and JWT handling, auditing API key usage and scoping, looking at how sensitive data is handled, and scanning for vulnerabilities such as injection risks and CORS settings. GDPR and SOC2 checks are part of the framework too.
It works through an MCP integration with Supabase, so that has to be set up first — there is nothing to inspect without access to the project. The tool list is Read, Write, Edit, Bash, which means the command can edit config files rather than only produce a report. Expect output as a written audit with vulnerabilities, policy recommendations and suggested fixes.
What it helps with
- catch RLS policy gaps before someone else does
- spot roles that hold more table permissions than they need
- review auth configuration and JWT handling
- find where API keys are exposed and how they are scoped
- produce a security write-up that covers GDPR and SOC2 checks
Example prompts for the agent
- /supabase-security-audit --rls
- /supabase-security-audit --comprehensive
- /supabase-security-audit --api-keys
How to install supabase-security-audit
1claude-code-templates
npx claude-code-templates@latest --command database/supabase-security-audit2Manually: put the files in place
.claude/commands/supabase-security-audit.mdCall it with /supabase-security-audit. For all projects use ~/.claude/commands/
Manually: put the files in place
~/.codex/prompts/supabase-security-audit.mdCall it with /prompts:supabase-security-audit. Codex marks this format deprecated in favour of skills
Manually: put the files in place
.github/prompts/supabase-security-audit.prompt.mdManually: put the files in place
.gemini/commands/supabase-security-audit.tomlGemini stores commands as TOML: the prompt text goes into the prompt field
Questions about supabase-security-audit
How do I install supabase-security-audit in Claude?
Run npx claude-code-templates@latest --command database/supabase-security-audit. The command lands in .claude/commands/supabase-security-audit.md.
What does supabase-security-audit do?
It audits a Supabase project for security issues: RLS policies, role permissions, authentication, API keys and data handling, then reports vulnerabilities with recommendations.
What does the command need to run?
An MCP integration with Supabase, since that is how it reads policies and settings. It also touches project files, because Write and Edit are in its tool list.
Source text
supabase-security-audit.md · MIT
--- allowed-tools: Read, Write, Edit, Bash argument-hint: "[audit-scope] | --rls | --permissions | --auth | --api-keys | --comprehensive" description: Conduct comprehensive Supabase security audit with RLS analysis and vulnerability assessment --- # Supabase Security Audit Conduct comprehensive Supabase security audit with RLS policy analysis and vulnerability assessment: **$ARGUMENTS** ## Current Security Context - Supabase access: MCP integration for security analysis and policy review - RLS policies: Current Row Level Security implementation and policy effectiveness - Auth configuration: !`find . -name "*auth*" -o -name "*supabase*" | grep -E "\\.(js|ts|json)$" | head -5` authentication setup - API security: Current API key management and access control implementation ## Task Execute comprehensive security audit with vulnerability assessment and policy optimization: **Audit Scope**: Use $ARGUMENTS to focus on RLS policies, permission analysis, authentication security, API key management, or comprehensive security review **Security Audit Framework**: 1. **RLS Policy Analysis** - Review Row Level Security policies, test policy effectiveness, identify policy gaps, optimize policy performance 2. **Permission Assessment** - Analyze table permissions, review role-based access, validate permission hierarchies, identify over-privileged access 3. **Authentication Security** - Review auth configuration, analyze JWT security, validate session management, assess multi-factor authentication 4. **API Key Management** - Audit API key usage, review key rotation policies, validate key scoping, assess exposure risks 5. **Data Protection** - Analyze sensitive data handling, review encryption implementation, validate data masking, assess backup security 6. **Vulnerability Scanning** - Identify security vulnerabilities, assess injection risks, review CORS configuration, validate rate limiting **Advanced Features**: Automated security testing, policy simulation, vulnerability scoring, compliance checking, security monitoring setup. **Compliance Integration**: GDPR compliance checking, SOC2 requirements validation, security best practices enforcement, audit trail analysis. **Output**: Comprehensive security audit report with vulnerability assessments, policy recommendations, security improvements, and compliance validation.
© davila7 · MIT · davila7/claude-code-templates
