Skip to main content
affpapa.org
RU EN
skill CX Codex

supabase-report-compare — Claude Code skill: diff two audit reports

Diffs two Supabase security audit reports and sorts every finding into fixed, still open, or new. Useful after a round of fixes and for periodic reviews.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report-compare -a claude-code
Open on GitHub

What supabase-report-compare does

The skill takes two Markdown audit reports and lines up their findings. A match is decided by the finding ID such as P0-001, by component plus title, or by location — file, line, endpoint. Each finding then gets a status: gone from the newer report means fixed, present in both means still open, present only in the newer one means new.

You get a table split by P0, P1 and P2, a score and grade comparison, the fixed list with dates, what is still open, and a section for regressions. It also reports the share of findings closed and the average time to fix per severity. With three or more reports, a trend table across dates is added.

Both reports have to cover the same project and be in Markdown. They also need to come from the same skill set — otherwise the finding IDs and structure will not line up, and matching falls back to descriptions, which produces more false pairs.

What it helps with

  • confirm which security issues were actually closed
  • catch regressions in the latest audit
  • show how the score moved between two audits
  • count open findings per priority level
  • prepare a summary for a recurring security review

Example prompts for the agent

  • Compare security reports old-report.md and new-report.md
  • Compare reports/audit-v1.md with reports/audit-v2.md
  • What got fixed between these two audits, and what is new?

How to install supabase-report-compare

1Skills CLI (Vercel)

npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report-compare -a claude-code

2Manually: put the files in place

~/.claude/skills/supabase-report-compare/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/supabase-report-compare/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about supabase-report-compare

How do I install supabase-report-compare in Claude Code?

Run npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report-compare -a claude-code. The skill file lands at ~/.claude/skills/supabase-report-compare/SKILL.md.

What does supabase-report-compare do?

It matches two Supabase audit reports against each other and splits findings into fixed, remaining and new. It also reports the score change and the remediation rate.

What do I need for the comparison to work?

Two Markdown reports for the same project. Findings are matched by ID, component plus title, or location, so reports produced by the same skill set compare more accurately.

Source text

SKILL.md · MIT 
---
name: supabase-report-compare
description: Compare two security audit reports to track remediation progress and identify new vulnerabilities.
---

# Report Comparison

This skill compares two security audit reports to track progress over time.

## When to Use This Skill

- After fixing vulnerabilities, to verify remediation
- For periodic security reviews
- To track security posture over time
- To identify regression (new vulnerabilities)

## Prerequisites

- Two audit reports in Markdown format
- Reports should be from the same project

## Usage

### Basic Comparison

```
Compare security reports old-report.md and new-report.md
```

### With Specific Paths

```
Compare reports/audit-v1.md with reports/audit-v2.md
```

## Output Format

```
═══════════════════════════════════════════════════════════
 SECURITY AUDIT COMPARISON
═══════════════════════════════════════════════════════════

 Previous Audit: January 15, 2025
 Current Audit:  January 31, 2025
 Days Between:   16 days

 ─────────────────────────────────────────────────────────
 Score Comparison
 ─────────────────────────────────────────────────────────

 Previous Score: 35/100 (Grade: D)
 Current Score:  72/100 (Grade: C)
 Improvement:    +37 points ⬆️

 ┌────────────────────────────────────────────────────────┐
 │ Score Progress                                         │
 │                                                        │
 │  100 ┤                                                 │
 │   80 ┤                              ████████ 72       │
 │   60 ┤                              ████████          │
 │   40 ┤ ████████ 35                  ████████          │
 │   20 ┤ ████████                     ████████          │
 │    0 ┴─────────────────────────────────────────────── │
 │        Jan 15                       Jan 31            │
 └────────────────────────────────────────────────────────┘

 ─────────────────────────────────────────────────────────
 Findings Summary
 ─────────────────────────────────────────────────────────

 | Status      | P0  | P1  | P2  | Total |
 |-------------|-----|-----|-----|-------|
 | Previous    | 3   | 4   | 5   | 12    |
 | Current     | 0   | 2   | 4   | 6     |
 | Fixed       | 3   | 2   | 2   | 7     |
 | New         | 0   | 0   | 1   | 1     |

 ─────────────────────────────────────────────────────────
 Fixed Vulnerabilities ✅
 ─────────────────────────────────────────────────────────

 P0 (Critical) - ALL FIXED! 🎉

 ✅ P0-001: Service Role Key Exposed
    Status: FIXED
    Resolution: Key rotated, removed from client code
    Fixed on: January 16, 2025

 ✅ P0-002: Database Backups Publicly Accessible
    Status: FIXED
    Resolution: Bucket made private, files deleted
    Fixed on: January 16, 2025

 ✅ P0-003: Admin Function Privilege Escalation
    Status: FIXED
    Resolution: Added admin role verification
    Fixed on: January 17, 2025

 P1 (High) - 2 of 4 Fixed

 ✅ P1-001: Email Confirmation Disabled
    Status: FIXED
    Resolution: Email confirmation now required
    Fixed on: January 20, 2025

 ✅ P1-002: IDOR in get-user-data Function
    Status: FIXED
    Resolution: Added user ownership verification
    Fixed on: January 18, 2025

 P2 (Medium) - 2 of 5 Fixed

 ✅ P2-001: Weak Password Policy
    Status: FIXED
    Resolution: Minimum length increased to 10
    Fixed on: January 22, 2025

 ✅ P2-003: Disposable Emails Accepted
    Status: FIXED
    Resolution: Email validation added
    Fixed on: January 25, 2025

 ─────────────────────────────────────────────────────────
 Remaining Vulnerabilities ⚠️
 ─────────────────────────────────────────────────────────

 P1 (High) - 2 Remaining

 🟠 P1-003: User Enumeration via Timing Attack
    Status: OPEN (16 days)
    Priority: Address this week
    Note: Was in previous report, not yet fixed

 🟠 P1-004: Admin Channel Publicly Accessible
    Status: OPEN (16 days)
    Priority: Address this week

 P2 (Medium) - 3 Remaining

 🟡 P2-002: Wildcard CORS Origin
    Status: OPEN (16 days)

 🟡 P2-004: Verbose Error Messages
    Status: OPEN (16 days)

 🟡 P2-005: Rate Limiting Not Enforced on Functions
    Status: OPEN (16 days)

 ─────────────────────────────────────────────────────────
 New Vulnerabilities 🆕
 ─────────────────────────────────────────────────────────

 P2 (Medium) - 1 New Issue

 🆕 P2-006: New Storage Bucket Without RLS
    Severity: 🟡 P2
    Component: Storage
    Description: New bucket 'user-uploads' created without
                 RLS policies. Currently empty but will
                 need policies before production use.
    First Seen: January 31, 2025

 ─────────────────────────────────────────────────────────
 Progress Analysis
 ─────────────────────────────────────────────────────────

 Remediation Rate: 58% (7 of 12 fixed)

 By Severity:
 ├── P0 (Critical): 100% fixed ✅
 ├── P1 (High): 50% fixed
 └── P2 (Medium): 40% fixed

 Time to Fix (Average):
 ├── P0: 1.3 days (excellent)
 ├── P1: 3.5 days (good)
 └── P2: 5.5 days (acceptable)

 Regression: 1 new issue introduced
             (lower severity, acceptable)

 ─────────────────────────────────────────────────────────
 Recommendations
 ─────────────────────────────────────────────────────────

 1. CONTINUE PROGRESS
    Great work fixing all P0 issues! Focus now on
    remaining P1 issues:
    - User enumeration timing attack
    - Admin broadcast channel

 2. ADDRESS NEW ISSUE
    Configure RLS on 'user-uploads' bucket before
    it's used in production.

 3. SCHEDULE FOLLOW-UP
    Recommend another audit in 14 days to verify
    remaining fixes.

 ─────────────────────────────────────────────────────────
 Trend Analysis
 ─────────────────────────────────────────────────────────

 If you have 3+ reports, trend analysis is available:

 | Date       | Score | P0 | P1 | P2 | Total |
 |------------|-------|----|----|----| ------|
 | 2024-12-01 | 28    | 4  | 5  | 6  | 15    |
 | 2025-01-15 | 35    | 3  | 4  | 5  | 12    |
 | 2025-01-31 | 72    | 0  | 2  | 4  | 6     |

 Trend: Improving ⬆️

═══════════════════════════════════════════════════════════
```

## Comparison Logic

### Finding Matching

Findings are matched between reports using:

1. **ID match** — Same P0-001, P1-002, etc.
2. **Component + Title match** — Same issue description
3. **Location match** — Same file/line/endpoint

### Status Determination

| Previous | Current | Status |
|----------|---------|--------|
| Present | Absent | Fixed ✅ |
| Present | Present | Remaining ⚠️ |
| Absent | Present | New 🆕 |
| Absent | Absent | N/A |

### Score Calculation

```
Change = Current Score - Previous Score

Positive change = Improvement ⬆️
Negative change = Regression ⬇️
No change = Stable ➡️
```

## Context Output

```json
{
  "comparison": {
    "previous_date": "2025-01-15",
    "current_date": "2025-01-31",
    "previous_score": 35,
    "current_score": 72,
    "score_change": 37,
    "findings": {
      "previous_total": 12,
      "current_total": 6,
      "fixed": 7,
      "remaining": 5,
      "new": 1
    },
    "by_severity": {
      "P0": { "previous": 3, "current": 0, "fixed": 3, "new": 0 },
      "P1": { "previous": 4, "current": 2, "fixed": 2, "new": 0 },
      "P2": { "previous": 5, "current": 4, "fixed": 2, "new": 1 }
    },
    "remediation_rate": 0.58,
    "trend": "improving"
  }
}
```

## Report Output

The comparison generates `supabase-audit-comparison.md`:

```markdown
# Security Audit Comparison Report

## Summary

| Metric | Previous | Current | Change |
|--------|----------|---------|--------|
| Score | 35/100 | 72/100 | +37 ⬆️ |
| P0 Issues | 3 | 0 | -3 ✅ |
| P1 Issues | 4 | 2 | -2 ✅ |
| P2 Issues | 5 | 4 | -1 ✅ |
| Total | 12 | 6 | -6 ✅ |

## Fixed Issues (7)

[Detailed list of fixed issues...]

## Remaining Issues (5)

[Detailed list of remaining issues...]

## New Issues (1)

[Detailed list of new issues...]

## Recommendations

[Action items based on comparison...]
```

## Multiple Report Comparison

For trend analysis across 3+ reports:

```
Compare trend across reports/audit-*.md
```

Output includes:

- Score trend graph
- Issue count over time
- Average time to fix
- Recurring issues identification

## Best Practices

### Naming Convention

```
reports/
├── supabase-audit-2024-12-01.md
├── supabase-audit-2025-01-15.md
├── supabase-audit-2025-01-31.md
└── supabase-audit-comparison-2025-01-31.md
```

### Regular Audits

| Frequency | Purpose |
|-----------|---------|
| After fixes | Verify remediation |
| Monthly | Catch regressions |
| Before releases | Pre-production check |
| After incidents | Post-incident review |

### Tracking Progress

1. Keep all reports in version control
2. Link to issue tracker (GitHub, Jira)
3. Include in sprint planning
4. Report to stakeholders

## Related Skills

- `supabase-report` — Generate the reports to compare
- `supabase-pentest` — Run full audit
- `supabase-help` — Quick reference

© yoanbernabeu · MIT · yoanbernabeu/supabase-pentest-skills

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set19

supabase-audit-tables-list Enumerates tables exposed through the Supabase PostgREST API so you can see the attack surface before testing deeper. CX Codex +1 480installs supabase-detect This skill checks a web app for signs of Supabase and records what it finds. Use it before auditing an unfamiliar application. CX Codex +1 478installs supabase-extract-db-string Scans client-side code for PostgreSQL connection strings and exposed Supabase credentials. Use it when auditing an application before release. CX Codex +1 477installs supabase-audit-buckets-list Lists every storage bucket in a Supabase project with its configuration and flags public ones as risk. Useful before you test file access rules. CX Codex +1 474installs supabase-audit-buckets-read This skill walks your Supabase Storage buckets and reports what an anon key can actually reach. Useful before shipping, when you want proof that RLS policies hold. CX Codex +1 471installs supabase-audit-auth-signup Checks whether signup is open on your Supabase project and hunts for abuse vectors: spam accounts, weak passwords, disposable emails. CX Codex +1 473installs supabase-extract-jwt This skill finds Supabase JWTs in client code, cookies, and storage patterns, then inspects their claims. Use it when checking exposed credentials. CX Codex +1 465installs supabase-audit-authenticated Creates a test user in Supabase and compares what an authenticated account can reach against anonymous access. Finds IDOR, cross-user reads and privilege escalation. CX Codex +1 422installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor