cristianps1988

Supabase Two Doors — Security skill for Claude Code

Security community

Claude skill: audit and harden a Supabase project that has its own backend.

How to install Supabase Two Doors

This entry records only its repository, not the path inside it, so there is no exact command to give. Open cristianps1988/supabase-two-doors and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Supabase Two Doors does

Claude skill: audit and harden a Supabase project that has its own backend. Maps what anon/authenticated can reach (incl. default grants that survive REVOKE FROM PUBLIC), confirms locally only, freezes the surface in CI.

Alternatives in Security

Harden — Run the harden skill to perform a systematic project hardening audit 1k ★
Claude Bootstrap — Opinionated project initialization with security-first guardrails, spec-driven atomic todos, LLM testing patte 536 ★
Security — Validate wallet addresses and check token risk — honeypot detection, audit status, freeze authority, and secur 46 ★

README

supabase-two-doors

A Claude skill that audits and hardens a Supabase project that has **its own backend** in front of the same database.

The problem

If your API talks to Supabase Postgres and your frontend never calls Supabase for data, it's easy to believe the database is only reachable through your API. It isn't. PostgREST (`/rest/v1`, including every function at `/rest/v1/rpc/`), GraphQL and Storage are still there, and the key to knock on them, the anon key, is public by design.

What gets reached through that door is decided by Postgres privileges. Supabase grants `anon` and `authenticated` access to new objects in `public` **through default privileges granted to those roles by name**. So the usual Postgres reflex, `REVOKE ALL ... FROM PUBLIC`, leaves those grants in place. One `SECURITY DEFINER` function written for your backend then becomes an endpoint any browser can call.

That is how a real multi-tenant SaaS ended up with platform-admin functions callable by anyone with the anon key. This skill is the process that found and fixed that, written down so it can be repeated.

What it does

Phase	What happens	Touches
0. Scope	Ownership, environments, exposed schemas, how the frontend reaches data	nothing
1. Map the Supabase door	Security Advisor + 11 catalog queries: what `anon`/`authenticated`/`PUBLIC` can execute and access, default privileges, policies, views, buckets	read-only
2. Map the backend door	Connection role, tenant context, JWT verification, role checks, client IP, webhooks	reads code
3. Confirm	Each finding proven by a test against the local stack only	`localhost`
4. Fix	Migration templates: default-deny + allowlist, dedicated backend role, `session_user` fence, column guards	local migrations
5. Freeze	CI test that pins the exposed surface to a committed allowlist, plus canaries; every security test mutation-checked	CI
6. Report	Findings with door, evide