HUNT-SUPABASE — Supabase Exploitation

Crown Jewel Targets

Supabase is the open-source Firebase alternative. It uses Row Level Security (RLS) for access control, but RLS policies are frequently misconfigured — especially in rapid-development stacks (Lovable.dev, Bolt.new, Cursor).

Highest-value findings:

1. Public tables via anon key — REST API with anon key returns table data when RLS is disabled or policies are permissive. Critical.
2. RLS bypass via organization_id — UPDATE operation checks user ownership but NOT organization_id -> cross-tenant data access. Critical.
3. RPC functions returning global data — SECURITY DEFINER RPC functions that don't filter by auth.uid() -> all users' data. High.
4. Storage buckets without RLS — Public file listing, upload, and download. High.
5. Open signUp — Anyone can register and get a JWT. High.
6. Multi-tenant enumeration — Same broken-RLS patterns across multiple apps built by the same developer. Medium.

Phase 1 — Find the Supabase Project

Supabase is identified by its URL format: https://[PROJECT_REF].supabase.co and anon key format: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... (JWT starting with eyJ)