auth-supabase
Implements secure Supabase authentication flows for signup, login, and session management, ensuring best practices are followed.
Install this skill
Security score
The auth-supabase skill was audited on Feb 9, 2026 and we found 26 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 368 | emailRedirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/callback`, |
Template literal with variable interpolation in command context
| 632 | redirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/reset-password`, |
Template literal with variable interpolation in command context
| 673 | redirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/callback`, |
Template literal with variable interpolation in command context
| 717 | return NextResponse.redirect(`${requestUrl.origin}/dashboard`) |
Template literal with variable interpolation in command context
| 788 | return <div>{user ? `Logged in as ${user.email}` : 'Not logged in'}</div> |
Access to .env file
| 159 | **Required Variables (.env.local):** |
Access to .env file
| 222 | process.env.NEXT_PUBLIC_SUPABASE_URL!, |
Access to .env file
| 223 | process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY! |
Access to .env file
| 237 | process.env.NEXT_PUBLIC_SUPABASE_URL!, |
Access to .env file
| 238 | process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, |
Access to .env file
| 277 | process.env.NEXT_PUBLIC_SUPABASE_URL!, |
Access to .env file
| 278 | process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, |
Access to .env file
| 368 | emailRedirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/callback`, |
Access to .env file
| 632 | redirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/reset-password`, |
Access to .env file
| 673 | redirectTo: `${process.env.NEXT_PUBLIC_SITE_URL}/auth/callback`, |
External URL reference
| 163 | NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co |
External URL reference
| 170 | NEXT_PUBLIC_SITE_URL=http://localhost:3000 |
External URL reference
| 171 | NEXT_PUBLIC_REDIRECT_URL=http://localhost:3000/auth/callback |
External URL reference
| 185 | NEXT_PUBLIC_SITE_URL=https://yourdomain.com |
External URL reference
| 186 | NEXT_PUBLIC_REDIRECT_URL=https://yourdomain.com/auth/callback |
External URL reference
| 192 | - [ ] Set Site URL: `https://yourdomain.com` |
External URL reference
| 194 | - `http://localhost:3000/auth/callback` (development) |
External URL reference
| 195 | - `https://yourdomain.com/auth/callback` (production) |
External URL reference
| 937 | - [Supabase Auth Documentation](https://supabase.com/docs/guides/auth) |
External URL reference
| 938 | - [Supabase Auth Helpers for Next.js](https://supabase.com/docs/guides/auth/auth-helpers/nextjs) |
External URL reference
| 939 | - [Row Level Security Guide](https://supabase.com/docs/guides/auth/row-level-security) |