Firebase & Supabase Attack Skill

Exploit misconfigured Firebase (Firestore, Storage, Auth) and Supabase (REST API, Storage, Auth) backends. These BaaS platforms are the #1 source of massive data breaches in modern web apps when Row Level Security (RLS) is missing and API keys leak in JavaScript bundles. Confirmed on delivery-platform (204K WhatsApp conversations, 173K phone numbers), visa-processing-platform (64K users, 46K reports), fitness-chain (39K users, 5 Firebase projects, 21 credentials), dental-booking (9 clinics, 1,749 leads).

When to Use

• JavaScript bundle analysis reveals Firebase config (apiKey, projectId) or Supabase URL + anon key.
• Target uses a modern SPA (React, Vue, Angular) with BaaS backend.
• After js-secrets-extraction finds Firebase/Supabase identifiers.
• After source-leak-hunt finds .env with FIREBASE_* or SUPABASE_* variables.

Prerequisites

• terminal with curl, python3, jq.
• Firebase project ID or Supabase URL + anon key (from JS bundle, source leak, or recon).
• For Firebase SA key exploitation: python3 with google-auth library.

How to Run