---
title: "Supabase-pwn: security testing for Supabase (open source) | Daniel Christensen"
canonical_url: "https://danielchristensen.no/en/tools/supabase-pwn"
last_updated: "2026-09-02T13:55:00.116Z"
locale: en
meta:
  description: "Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only."
  "og:description": "Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only."
  "og:title": "Supabase-pwn: security testing for Supabase (open source)"
---

Open source · Pentest

# Supabase-pwn

A web-based toolkit for pentesting apps that run on Supabase. Point it at a project with an API key and probe for misconfigurations: exposed tables, broken RLS, open signups and leaky storage buckets.

[View on GitHub →](https://github.com/BobTheShoplifter/supabase-pwn)

I built supabase-pwn to make security-testing Supabase easier, inspired by firepwn-tool for Firebase. It runs locally on your machine: you connect with a project URL and key, and start probing. The key type (publishable, secret, anon or service role) is detected automatically.

⚠ For authorized testing only

This is an offensive tool. Only test Supabase projects you own yourself, or have written permission to test.

## What it does

- Database Explorer: SELECT, INSERT, UPDATE and DELETE against tables, with a filter builder and auto-fill.
- Table Bruteforcer: guess common table names when the schema is blocked.
- Storage Explorer: list buckets, browse files, and test upload, download and signed URLs.
- Auth probing: test sign-up, sign-in, anonymous auth and OAuth redirects.
- Edge Functions and Realtime: invoke functions and subscribe to changes live.
- Autopwn: an automated scan of RLS, storage, auth and edge functions, with a colour-coded access matrix.

## Getting started

Clone the repo, install, and run it locally. Open localhost, paste your project URL and API key, and hit Initialize.

```
git clone https://github.com/BobTheShoplifter/supabase-pwn.git
cd supabase-pwn
npm install
npm run dev
```

Need a hand?

## Not sure your Supabase setup is safe?

I do security reviews and pentesting for companies, including Supabase, APIs and cloud setups. Get in touch and we'll look at it together.

[Get in touch →](https://danielchristensen.no/en/contact)