--- title: "Supabase-pwn: Supabase security testing | Daniel Christensen" description: "Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only." canonical_url: "https://danielchristensen.no/en/tools/supabase-pwn" last_updated: "2026-09-07T12:05:03.106Z" locale: en meta: "og:description": "Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only." "og:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Supabase-pwn%2Csubtitle_Security%2Btesting%2Bfor%2BSupabase%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cp_Ii9lbi90b29scy9zdXBhYmFzZS1wd24i%2Cs_vYMOY69ixjzouDw1.png" "og:image:height": "600" "og:image:type": image/png "og:image:width": "1200" "og:title": "Supabase-pwn: Supabase security testing" "twitter:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Supabase-pwn%2Csubtitle_Security%2Btesting%2Bfor%2BSupabase%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cp_Ii9lbi90b29scy9zdXBhYmFzZS1wd24i%2Cs_vYMOY69ixjzouDw1.png" --- > Index of every page on this site: [llms.txt](https://danielchristensen.no/llms.txt) Open source · Pentest # Supabase-pwn A web-based toolkit for pentesting apps that run on Supabase. Point it at a project with an API key and probe for misconfigurations: exposed tables, broken RLS, open signups and leaky storage buckets. [View on GitHub →](https://github.com/BobTheShoplifter/supabase-pwn) ![supabasePwn.heroAlt](https://danielchristensen.no/_ipx/f_webp&q_90&s_1440x810/assets/verktoy-supabase-pwn.png) I built supabase-pwn to make security-testing Supabase easier, inspired by firepwn-tool for Firebase. It runs locally on your machine: you connect with a project URL and key, and start probing. The key type (publishable, secret, anon or service role) is detected automatically. ⚠ For authorized testing only This is an offensive tool. Only test Supabase projects you own yourself, or have written permission to test. ## What it does - Database Explorer: SELECT, INSERT, UPDATE and DELETE against tables, with a filter builder and auto-fill. - Table Bruteforcer: guess common table names when the schema is blocked. - Storage Explorer: list buckets, browse files, and test upload, download and signed URLs. - Auth probing: test sign-up, sign-in, anonymous auth and OAuth redirects. - Edge Functions and Realtime: invoke functions and subscribe to changes live. - Autopwn: an automated scan of RLS, storage, auth and edge functions, with a colour-coded access matrix. ## Getting started Clone the repo, install, and run it locally. Open localhost, paste your project URL and API key, and hit Initialize. ``` git clone https://github.com/BobTheShoplifter/supabase-pwn.git cd supabase-pwn npm install npm run dev ``` Need a hand? ## Not sure your Supabase setup is safe? I do security reviews and pentesting for companies, including Supabase, APIs and cloud setups. Get in touch and we'll look at it together. [Get in touch →](https://danielchristensen.no/en/contact) ```json {"@context":"https://schema.org","@graph":[{"@id":"https://danielchristensen.no/en#website","@type":"WebSite","description":"Ethical hacker and keynote speaker. Talks on digital security, pentesting and how to avoid getting hacked.","inLanguage":"en","name":"Daniel Christensen","url":"https://danielchristensen.no/en","publisher":{"@id":"https://danielchristensen.no/#identity"},"translationOfWork":{"@id":"https://danielchristensen.no/#website"}},{"@id":"https://danielchristensen.no/en/tools/supabase-pwn#webpage","@type":"WebPage","description":"Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only.","name":"Supabase-pwn: Supabase security testing","url":"https://danielchristensen.no/en/tools/supabase-pwn","breadcrumb":{"@id":"https://danielchristensen.no/en/tools/supabase-pwn#/schema/breadcrumb-list/#breadcrumb"},"isPartOf":{"@id":"https://danielchristensen.no/en#website"},"mainEntity":{"@id":"https://danielchristensen.no/en/tools/supabase-pwn#code"},"potentialAction":[{"@type":"ReadAction","target":["https://danielchristensen.no/en/tools/supabase-pwn"]}]},{"@id":"https://danielchristensen.no/#identity","@type":"Person","alternateName":"BobTheShoplifter","description":"Ethical hacker, speaker and content creator (BobTheShoplifter). Talks on digital security and pentesting.","name":"Daniel Christensen","url":"https://danielchristensen.no","address":{"@type":"PostalAddress","addressLocality":"Oslo","addressRegion":"Oslo","addressCountry":"NO"},"contactPoint":{"@type":"ContactPoint","telephone":"+4798332280","email":"daniel@websecured.io","contactType":"booking","areaServed":"NO","availableLanguage":["nb","en"]},"image":{"@id":"https://danielchristensen.no/#/schema/image/1"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"FollowAction"},"userInteractionCount":130500},"jobTitle":["Ethical hacker","Keynote speaker","Content creator"],"knowsAbout":["Digital security","Cybersecurity","Ethical hacking","Penetration testing","Social engineering","Fraud and phishing"],"sameAs":["https://www.wikidata.org/wiki/Q109401760","https://www.tiktok.com/@bobtheshoplifter","https://www.instagram.com/bobtheshoplifter","https://www.youtube.com/channel/UCp2mLClUy4kwbg_uUWbR_5w","https://www.linkedin.com/in/-daniel-/","https://twitter.com/BobTShoplifter","https://www.facebook.com/daniel.christensen.5648/"],"worksFor":{"@type":"Organization","name":"Websecured","url":"https://websecured.io"}},{"@id":"https://danielchristensen.no/en/tools/supabase-pwn#/schema/breadcrumb-list/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://danielchristensen.no/en","position":1},{"@type":"ListItem","name":"Tools","item":"https://danielchristensen.no/en/tools","position":2},{"@type":"ListItem","name":"Supabase-pwn","item":"https://danielchristensen.no/en/tools/supabase-pwn","position":3}]},{"@id":"https://danielchristensen.no/en/tools/supabase-pwn#code","@type":"SoftwareSourceCode","codeRepository":"https://github.com/BobTheShoplifter/supabase-pwn","description":"Free, open-source tool to security-test Supabase: exposed tables, broken RLS, open signups, leaky storage buckets. For authorized testing only.","inLanguage":"en","isAccessibleForFree":true,"license":"https://opensource.org/license/mit","name":"supabase-pwn","programmingLanguage":"TypeScript","runtimePlatform":"Node.js","url":"https://danielchristensen.no/en/tools/supabase-pwn","author":{"@id":"https://danielchristensen.no/#identity"}},{"@id":"https://danielchristensen.no/#/schema/image/1","@type":"ImageObject","contentUrl":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg","inLanguage":"en","url":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg"}]} ``` ## Sitemap See the full [sitemap](https://danielchristensen.no/sitemap.md) for all pages.