domains / families / security / hunt-supabase

hunt-supabase

separate

Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-tenant enumeration via WHOIS, bucket file upload/download without auth. Built from field observation of Lovable.dev + Supabase stack on rapidly-built platforms where RLS policies are consistently misconfigured. Use when a JS bundle, .env, or APK reveals a Supabase URL (project.supabase.co) and anon key (eyJ...).

When to use

• Supabase anon key discovery in JS bundles
• REST API table enumeration with anon key
• Row Level Security (RLS) bypass via missing organization_id check
• RPC function abuse returning cross-organization data
• Storage bucket listing
• Auth signUp/signIn with anon key
• Multi-tenant enumeration via WHOIS
• Bucket file upload/download without auth

Skill page

Source