{"id":50653097,"url":"https://github.com/sharwin-dev/supabase-rls-audit-kit","last_synced_at":"2026-06-07T22:02:19.725Z","repository":{"id":363125296,"uuid":"1258385995","full_name":"sharwin-dev/supabase-rls-audit-kit","owner":"sharwin-dev","description":"CLI checks for common Supabase/Postgres RLS security footguns.","archived":false,"fork":false,"pushed_at":"2026-06-07T14:15:59.000Z","size":28,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-07T16:10:02.160Z","etag":null,"topics":["audit","cli","postgres","postgresql","rls","row-level-security","saas","security","supabase"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sharwin-dev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-03T14:27:53.000Z","updated_at":"2026-06-07T14:13:08.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/sharwin-dev/supabase-rls-audit-kit","commit_stats":null,"previous_names":["sharwin-dev/supabase-rls-audit-kit"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/sharwin-dev/supabase-rls-audit-kit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sharwin-dev%2Fsupabase-rls-audit-kit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sharwin-dev%2Fsupabase-rls-audit-kit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sharwin-dev%2Fsupabase-rls-audit-kit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sharwin-dev%2Fsupabase-rls-audit-kit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sharwin-dev","download_url":"https://codeload.github.com/sharwin-dev/supabase-rls-audit-kit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sharwin-dev%2Fsupabase-rls-audit-kit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34039495,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-07T02:00:07.652Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","cli","postgres","postgresql","rls","row-level-security","saas","security","supabase"],"created_at":"2026-06-07T22:02:17.890Z","updated_at":"2026-06-07T22:02:19.706Z","avatar_url":"https://github.com/sharwin-dev.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# supabase-rls-audit-kit\n\nSmall CLI checks for common Supabase/Postgres Row Level Security footguns.\n\nThis project is for indie SaaS builders and maintainers who want a repeatable way to inspect public-schema RLS posture before shipping database changes.\n\n## What It Checks\n\n- Tables in exposed schemas with RLS disabled.\n- Tables with RLS enabled but no policies.\n- Grants to `anon` or `authenticated` on tables.\n- Policies that reference unsafe user-editable JWT metadata.\n- `SECURITY DEFINER` functions in exposed schemas.\n- Functions executable by `anon` or `authenticated`.\n- Views in exposed schemas that may bypass RLS.\n- Broad Storage policies and incomplete authenticated upsert policy coverage.\n\n## Install\n\n```bash\nnpm install\n```\n\n## Run\n\n```bash\nDATABASE_URL=\"postgres://...\" npm start -- --format text\n```\n\nOr after linking/installing:\n\n```bash\nrls-audit --database-url \"$DATABASE_URL\"\n```\n\nJSON output:\n\n```bash\nrls-audit --database-url \"$DATABASE_URL\" --format json\n```\n\nThe JSON contract is documented in [`docs/json-output.md`](docs/json-output.md), with a schema at [`schemas/finding.schema.json`](schemas/finding.schema.json).\n\nGitHub Actions usage is documented in [`docs/github-actions.md`](docs/github-actions.md), with a workflow example at [`examples/github-action/rls-audit.yml`](examples/github-action/rls-audit.yml).\n\nSupabase CLI local usage is documented in [`docs/supabase-cli-local.md`](docs/supabase-cli-local.md), with a local example at [`examples/supabase-local`](examples/supabase-local).\n\nTenant-isolation fixtures are documented in [`docs/tenant-isolation-fixtures.md`](docs/tenant-isolation-fixtures.md).\n\nStorage policy checks are documented in [`docs/storage-policy-checks.md`](docs/storage-policy-checks.md).\n\n## Safety\n\nThe CLI runs read-only catalog queries. It does not mutate the database.\n\nDo not run it with production credentials unless you understand the connection target and access scope. Prefer read-only or temporary credentials where possible.\n\n## Severity Model\n\n- `HIGH`: likely access-control vulnerability or exposed privileged path.\n- `MEDIUM`: missing policy/guardrail that may be safe only if intentionally private.\n- `WARN`: review-needed pattern.\n\n## Examples\n\nSee:\n\n- [`examples/bad`](examples/bad)\n- [`examples/good`](examples/good)\n\n## Development\n\n```bash\nnpm test\nnpm run lint\n```\n\n## Maturity\n\nThis is an early-stage audit helper. It is not a replacement for manual security review, Supabase advisors, or a production threat model.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsharwin-dev%2Fsupabase-rls-audit-kit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsharwin-dev%2Fsupabase-rls-audit-kit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsharwin-dev%2Fsupabase-rls-audit-kit/lists"}