domains / families / security / firebase-supabase-attack

firebase-supabase-attack

separate

Exploit Firebase/Supabase for data via JS config leak probe.

When to use

• JavaScript bundle analysis reveals Firebase config (`apiKey`, `projectId`) or Supabase URL + anon key.
• Target uses a modern SPA (React, Vue, Angular) with BaaS backend.
• After `js-secrets-extraction` finds Firebase/Supabase identifiers.
• After `source-leak-hunt` finds `.env` with `FIREBASE_*` or `SUPABASE_*` variables.

Skill page

Source