supabase-security-audit

Run a comprehensive Supabase security audit: $ARGUMENTS

Default project ID comes from CLAUDE.md or the user's request. If no project ID is provided, check CLAUDE.md for the Supabase project reference.

Audit Protocol

Run all checks in order from most critical to least. For each check, execute the SQL query, analyze the result, and record the finding with a severity rating.

Severity Levels

• CRITICAL — Actively exploitable. Data can be read, modified, or deleted by unauthorized users right now.
• HIGH — Significant exposure that becomes exploitable with minimal effort (e.g., public anon key + no RLS).
• MEDIUM — Security gap that increases attack surface but requires additional conditions to exploit.
• LOW — Best-practice violation that should be addressed but poses limited immediate risk.
• INFO — Observation worth noting for awareness.