Open source · Pentest

Supabase-pwn

A web-based toolkit for pentesting apps that run on Supabase. Point it at a project with an API key and probe for misconfigurations: exposed tables, broken RLS, open signups and leaky storage buckets.

View on GitHub →

I built supabase-pwn to make security-testing Supabase easier, inspired by firepwn-tool for Firebase. It runs locally on your machine: you connect with a project URL and key, and start probing. The key type (publishable, secret, anon or service role) is detected automatically.

⚠ For authorized testing only

This is an offensive tool. Only test Supabase projects you own yourself, or have written permission to test.

What it does

Database Explorer: SELECT, INSERT, UPDATE and DELETE against tables, with a filter builder and auto-fill.
Table Bruteforcer: guess common table names when the schema is blocked.
Storage Explorer: list buckets, browse files, and test upload, download and signed URLs.
Auth probing: test sign-up, sign-in, anonymous auth and OAuth redirects.
Edge Functions and Realtime: invoke functions and subscribe to changes live.
Autopwn: an automated scan of RLS, storage, auth and edge functions, with a colour-coded access matrix.

Getting started

Clone the repo, install, and run it locally. Open localhost, paste your project URL and API key, and hit Initialize.

git clone https://github.com/BobTheShoplifter/supabase-pwn.git
cd supabase-pwn
npm install
npm run dev

Need a hand?

Not sure your Supabase setup is safe?

I do security reviews and pentesting for companies, including Supabase, APIs and cloud setups. Get in touch and we'll look at it together.

Get in touch →