supascan 0.0.10 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +60 -110
  2. package/dist/supascan.js +78 -15839
  3. package/package.json +3 -3
package/README.md CHANGED
@@ -1,145 +1,88 @@
1
1
  # supascan
2
2
 
3
- A security analysis CLI tool for Supabase databases that helps identify exposed data, analyze schemas, and test RPC functions.
3
+ [![.github/workflows/tests.yml](https://github.com/abhishekg999/supascan/actions/workflows/tests.yml/badge.svg)](https://github.com/abhishekg999/supascan/actions/workflows/tests.yml) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://raw.githubusercontent.com/abhishekg999/supascan/master/LICENCE)
4
4
 
5
- ## Installation
5
+ **supascan** is an automated security scanner for Supabase databases. It detects exposed data, analyzes Row Level Security (RLS) policies, tests RPC functions, and generates comprehensive security reports.
6
6
 
7
- ```bash
8
- bun install -g supascan
9
- ```
7
+ ## Features
10
8
 
11
- ## Usage
9
+ - Automated schema and table discovery
10
+ - RLS policy effectiveness testing
11
+ - Exposed data detection with row count estimation
12
+ - RPC function parameter analysis and testing
13
+ - JWT token decoding and validation
14
+ - Multiple output formats (Console, JSON, HTML)
15
+ - Interactive HTML reports with live query interface
16
+ - Credential extraction from JavaScript files (experimental)
12
17
 
13
- ### Basic Analysis
18
+ ## Installation
14
19
 
15
- Analyze your Supabase database for security issues:
20
+ **NPM:**
16
21
 
17
22
  ```bash
18
- supascan --url https://your-project.supabase.co --key your-anon-key
23
+ npm install -g supascan
19
24
  ```
20
25
 
21
- ### Available Commands
22
-
23
- #### Database Analysis
26
+ **Bun:**
24
27
 
25
28
  ```bash
26
- # Analyze all schemas
27
- supascan --url <url> --key <key>
28
-
29
- # Analyze specific schema
30
- supascan --url <url> --key <key> --schema public
31
-
32
- # Generate HTML report
33
- supascan --url <url> --key <key> --html
34
-
35
- # JSON output
36
- supascan --url <url> --key <key> --json
29
+ bun install -g supascan
37
30
  ```
38
31
 
39
- #### Data Dumping
32
+ **From source:**
40
33
 
41
34
  ```bash
42
- # Dump table data
43
- supascan --url <url> --key <key> --dump public.users --limit 100
44
-
45
- # Dump Swagger JSON for schema
46
- supascan --url <url> --key <key> --dump public
35
+ git clone https://github.com/abhishekg999/supascan.git
36
+ cd supascan
37
+ bun install
38
+ bun run build
47
39
  ```
48
40
 
49
- #### RPC Testing
50
-
51
- ```bash
52
- # Get RPC help
53
- supascan --url <url> --key <key> --rpc public.get_user_stats
54
-
55
- # Call RPC with parameters
56
- supascan --url <url> --key <key> --rpc public.get_user_stats --args '{"user_id": "123"}'
57
-
58
- # Show query execution plan
59
- supascan --url <url> --key <key> --rpc public.get_user_stats --args '{"user_id": "123"}' --explain
60
- ```
41
+ ## Usage
61
42
 
62
- #### Credential Extraction (Experimental)
43
+ To get basic options and usage:
63
44
 
64
45
  ```bash
65
- # Extract credentials from JS file
66
- supascan --extract https://example.com/app.js --url <url> --key <key>
46
+ supascan --help
67
47
  ```
68
48
 
69
- ## Options
70
-
71
- | Option | Description |
72
- | ---------------------------------- | ---------------------------------------------------------------- |
73
- | `-u, --url <url>` | Supabase URL |
74
- | `-k, --key <key>` | Supabase anon key |
75
- | `-s, --schema <schema>` | Schema to analyze (default: all schemas) |
76
- | `-x, --extract <url>` | Extract credentials from JS file URL (experimental) |
77
- | `--dump <schema.table\|schema>` | Dump data from specific table or swagger JSON from schema |
78
- | `--limit <number>` | Limit rows for dump or RPC results (default: 10) |
79
- | `--rpc <schema.rpc_name>` | Call an RPC function (read-only operations only) |
80
- | `--args <json>` | JSON arguments for RPC call (use $VAR for environment variables) |
81
- | `--json` | Output as JSON |
82
- | `--html` | Generate HTML report |
83
- | `-d, --debug` | Enable debug mode |
84
- | `--explain` | Show query execution plan |
85
- | `--suppress-experimental-warnings` | Suppress experimental warnings |
86
-
87
- ## What supascan Analyzes
49
+ ### Quick Start
88
50
 
89
- ### Database Security Assessment
90
-
91
- - **Schema Discovery**: Automatically discovers all available schemas
92
- - **Table Access Analysis**: Identifies which tables are:
93
- - ✅ **Readable** - Data is exposed and accessible
94
- - ⚠️ **Empty/Protected** - No data or protected by RLS
95
- - ❌ **Denied** - Access is explicitly denied
96
-
97
- ### JWT Token Analysis
98
-
99
- - Parses and displays JWT token information
100
- - Shows issuer, audience, expiration, and role information
101
-
102
- ### RPC Function Analysis
103
-
104
- - Lists all available RPC functions
105
- - Shows parameter requirements and types
106
- - Validates parameters before execution
107
-
108
- ### Output Formats
109
-
110
- - **Console**: Colorized terminal output with detailed analysis
111
- - **JSON**: Machine-readable output for scripting
112
- - **HTML**: Visual report that opens in your browser
113
-
114
- ## Examples
51
+ ```bash
52
+ # Basic security scan
53
+ supascan --url https://your-project.supabase.co --key your-anon-key
115
54
 
116
- ### Security Analysis Report
55
+ # Generate HTML report
56
+ supascan --url https://your-project.supabase.co --key your-anon-key --html
117
57
 
118
- ```bash
119
- supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --html
120
- ```
58
+ # Analyze specific schema
59
+ supascan --url https://your-project.supabase.co --key your-anon-key --schema public
121
60
 
122
- ### Check Specific Table Access
61
+ # Dump table data
62
+ supascan --url https://your-project.supabase.co --key your-anon-key --dump public.users --limit 100
123
63
 
124
- ```bash
125
- supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --dump public.users --limit 5
64
+ # Test RPC function
65
+ supascan --url https://your-project.supabase.co --key your-anon-key --rpc public.my_function --args '{"param": "value"}'
126
66
  ```
127
67
 
128
- ### Test RPC Function
68
+ ## What supascan Detects
129
69
 
130
- ```bash
131
- supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --rpc public.get_user_count --args '{"active": true}'
132
- ```
70
+ - **Exposed Tables**: Tables readable without authentication or with weak RLS
71
+ - **Data Leakage**: Estimated row counts for accessible tables
72
+ - **RPC Vulnerabilities**: Publicly callable functions and their parameters
73
+ - **JWT Issues**: Token expiration, role assignments, and claims
74
+ - **Schema Information**: Complete database structure visibility
133
75
 
134
76
  ## Security Considerations
135
77
 
136
- ⚠️ **Important**: This tool is designed for security analysis and testing. Only use it on:
78
+ ⚠️ **Important**: This tool is for authorized security testing only.
137
79
 
138
- - Your own databases
139
- - Databases you have explicit permission to test
140
- - Staging/development environments
80
+ - Only scan databases you own or have explicit permission to test
81
+ - Use on staging/development environments when possible
82
+ - Never use on production databases without proper authorization
83
+ - Be aware that scanning may trigger rate limits or monitoring alerts
141
84
 
142
- Never use this tool on production databases without proper authorization.
85
+ Unauthorized database scanning may be illegal in your jurisdiction.
143
86
 
144
87
  ## Development
145
88
 
@@ -150,12 +93,19 @@ bun install
150
93
  # Run locally
151
94
  bun run start
152
95
 
96
+ # Run tests
97
+ bun test
98
+
153
99
  # Build
154
100
  bun run build
101
+ ```
155
102
 
156
- # Test
157
- bun test
103
+ ## License
158
104
 
159
- # Lint
160
- bun run lint
161
- ```
105
+ supascan is distributed under the [MIT License](LICENCE).
106
+
107
+ ## Links
108
+
109
+ - **Homepage**: https://github.com/abhishekg999/supascan
110
+ - **Issues**: https://github.com/abhishekg999/supascan/issues
111
+ - **NPM**: https://www.npmjs.com/package/supascan