Supabase Developer
Enables developers to build full-stack applications using Supabase's features like authentication, real-time data, and serverless functions.
Install this skill
Security score
The Supabase Developer skill was audited on Feb 27, 2026 and we found 28 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 724 | filter: `user_id=eq.${userId}` |
Webhook reference - potential data exfiltration
| 103 | - Background jobs and webhooks |
Webhook reference - potential data exfiltration
| 854 | #### 6.2 Database Webhooks |
Webhook reference - potential data exfiltration
| 857 | -- Send webhook on new post |
Webhook reference - potential data exfiltration
| 858 | CREATE OR REPLACE FUNCTION send_post_webhook() |
Webhook reference - potential data exfiltration
| 863 | url := 'https://your-api.com/webhook', |
Webhook reference - potential data exfiltration
| 878 | EXECUTE FUNCTION send_post_webhook(); |
Access to .env file
| 143 | # .env.local |
Access to .env file
| 155 | const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL! |
Access to .env file
| 156 | const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY! |
Access to .env file
| 169 | process.env.NEXT_PUBLIC_SUPABASE_URL!, |
Access to .env file
| 170 | process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY! |
Access to .env file
| 182 | process.env.NEXT_PUBLIC_SUPABASE_URL!, |
Access to .env file
| 183 | process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, |
Access to .env file
| 814 | Deno.env.get('SUPABASE_URL') ?? '', |
Access to .env file
| 815 | Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') ?? '' |
Access to .env file
| 1155 | process.env.TEST_SUPABASE_URL!, |
Access to .env file
| 1156 | process.env.TEST_SUPABASE_ANON_KEY! |
Access to .env file
| 1420 | import.meta.env.VITE_SUPABASE_URL, |
Access to .env file
| 1421 | import.meta.env.VITE_SUPABASE_ANON_KEY |
External URL reference
| 118 | # 1. Go to https://supabase.com |
External URL reference
| 144 | NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co |
External URL reference
| 212 | emailRedirectTo: 'https://yourapp.com/auth/callback' |
External URL reference
| 246 | redirectTo: 'https://yourapp.com/auth/callback', |
External URL reference
| 268 | emailRedirectTo: 'https://yourapp.com/auth/callback' |
External URL reference
| 807 | import { serve } from 'https://deno.land/[email protected]/http/server.ts' |
External URL reference
| 808 | import { createClient } from 'https://esm.sh/@supabase/supabase-js@2' |
External URL reference
| 863 | url := 'https://your-api.com/webhook', |