Hey ProductHunt 👋 Vathsal here, one of the founders at Noblle. Built this after we found a user_metadata RBAC bug in our own Supabase project, our RLS policy was checking auth.jwt() -> 'user_metadata' ->> 'role', which means any user could just call supabase.auth.updateUser({ data: { role: 'admin' } }) and promote themselves. Policy looked totally fine on review. Started cataloguing all the Supabase security holes we kept seeing across projects and turned it into a scanner. The getSession() vs getUser() one is the most common — they look identical, getSession() just never validates the token with the Auth server so a crafted cookie walks right through. npx supafix, no install, scans in under a second. A few things I'd love feedback on: - False positive rate : if it flags something that's genuinely fine, tell me. I'd rather it be quiet and right than noisy and ignored. - Missing checks : what Supabase footgun have you personally stepped on that we're not catching? - The --fix flag : it generates a migration for missing RLS. Useful or too scary to trust? All open source, MIT. GitHub's in the links.

supafix

Fast security audit for Supabase projects. Fix it. Secure it

Fast security audit for Supabase projects. Fix it. Secure it