supascan 0.0.9 → 0.1.0

package/README.md

@@ -1,145 +1,88 @@
 # supascan
 
-A security analysis CLI tool for Supabase databases that helps identify exposed data, analyze schemas, and test RPC functions.
+[![.github/workflows/tests.yml](https://github.com/abhishekg999/supascan/actions/workflows/tests.yml/badge.svg)](https://github.com/abhishekg999/supascan/actions/workflows/tests.yml) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://raw.githubusercontent.com/abhishekg999/supascan/master/LICENCE)
 
-## Installation
+**supascan** is an automated security scanner for Supabase databases. It detects exposed data, analyzes Row Level Security (RLS) policies, tests RPC functions, and generates comprehensive security reports.
 
-```bash
-bun install -g supascan
-```
+## Features
 
-## Usage
+- Automated schema and table discovery
+- RLS policy effectiveness testing
+- Exposed data detection with row count estimation
+- RPC function parameter analysis and testing
+- JWT token decoding and validation
+- Multiple output formats (Console, JSON, HTML)
+- Interactive HTML reports with live query interface
+- Credential extraction from JavaScript files (experimental)
 
-### Basic Analysis
+## Installation
 
-Analyze your Supabase database for security issues:
+**NPM:**
 
 ```bash
-supascan --url https://your-project.supabase.co --key your-anon-key
+npm install -g supascan
 ```
 
-### Available Commands
-
-#### Database Analysis
+**Bun:**
 
 ```bash
-# Analyze all schemas
-supascan --url <url> --key <key>
-
-# Analyze specific schema
-supascan --url <url> --key <key> --schema public
-
-# Generate HTML report
-supascan --url <url> --key <key> --html
-
-# JSON output
-supascan --url <url> --key <key> --json
+bun install -g supascan
 ```
 
-#### Data Dumping
+**From source:**
 
 ```bash
-# Dump table data
-supascan --url <url> --key <key> --dump public.users --limit 100
-
-# Dump Swagger JSON for schema
-supascan --url <url> --key <key> --dump public
+git clone https://github.com/abhishekg999/supascan.git
+cd supascan
+bun install
+bun run build
 ```
 
-#### RPC Testing
-
-```bash
-# Get RPC help
-supascan --url <url> --key <key> --rpc public.get_user_stats
-
-# Call RPC with parameters
-supascan --url <url> --key <key> --rpc public.get_user_stats --args '{"user_id": "123"}'
-
-# Show query execution plan
-supascan --url <url> --key <key> --rpc public.get_user_stats --args '{"user_id": "123"}' --explain
-```
+## Usage
 
-#### Credential Extraction (Experimental)
+To get basic options and usage:
 
 ```bash
-# Extract credentials from JS file
-supascan --extract https://example.com/app.js --url <url> --key <key>
+supascan --help
 ```
 
-## Options
-
-| Option                             | Description                                                      |
-| ---------------------------------- | ---------------------------------------------------------------- |
-| `-u, --url <url>`                  | Supabase URL                                                     |
-| `-k, --key <key>`                  | Supabase anon key                                                |
-| `-s, --schema <schema>`            | Schema to analyze (default: all schemas)                         |
-| `-x, --extract <url>`              | Extract credentials from JS file URL (experimental)              |
-| `--dump <schema.table\|schema>`    | Dump data from specific table or swagger JSON from schema        |
-| `--limit <number>`                 | Limit rows for dump or RPC results (default: 10)                 |
-| `--rpc <schema.rpc_name>`          | Call an RPC function (read-only operations only)                 |
-| `--args <json>`                    | JSON arguments for RPC call (use $VAR for environment variables) |
-| `--json`                           | Output as JSON                                                   |
-| `--html`                           | Generate HTML report                                             |
-| `-d, --debug`                      | Enable debug mode                                                |
-| `--explain`                        | Show query execution plan                                        |
-| `--suppress-experimental-warnings` | Suppress experimental warnings                                   |
-
-## What supascan Analyzes
+### Quick Start
 
-### Database Security Assessment
-
-- **Schema Discovery**: Automatically discovers all available schemas
-- **Table Access Analysis**: Identifies which tables are:
-  - ✅ **Readable** - Data is exposed and accessible
-  - ⚠️ **Empty/Protected** - No data or protected by RLS
-  - ❌ **Denied** - Access is explicitly denied
-
-### JWT Token Analysis
-
-- Parses and displays JWT token information
-- Shows issuer, audience, expiration, and role information
-
-### RPC Function Analysis
-
-- Lists all available RPC functions
-- Shows parameter requirements and types
-- Validates parameters before execution
-
-### Output Formats
-
-- **Console**: Colorized terminal output with detailed analysis
-- **JSON**: Machine-readable output for scripting
-- **HTML**: Visual report that opens in your browser
-
-## Examples
+```bash
+# Basic security scan
+supascan --url https://your-project.supabase.co --key your-anon-key
 
-### Security Analysis Report
+# Generate HTML report
+supascan --url https://your-project.supabase.co --key your-anon-key --html
 
-```bash
-supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --html
-```
+# Analyze specific schema
+supascan --url https://your-project.supabase.co --key your-anon-key --schema public
 
-### Check Specific Table Access
+# Dump table data
+supascan --url https://your-project.supabase.co --key your-anon-key --dump public.users --limit 100
 
-```bash
-supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --dump public.users --limit 5
+# Test RPC function
+supascan --url https://your-project.supabase.co --key your-anon-key --rpc public.my_function --args '{"param": "value"}'
 ```
 
-### Test RPC Function
+## What supascan Detects
 
-```bash
-supascan --url https://abc123.supabase.co --key eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --rpc public.get_user_count --args '{"active": true}'
-```
+- **Exposed Tables**: Tables readable without authentication or with weak RLS
+- **Data Leakage**: Estimated row counts for accessible tables
+- **RPC Vulnerabilities**: Publicly callable functions and their parameters
+- **JWT Issues**: Token expiration, role assignments, and claims
+- **Schema Information**: Complete database structure visibility
 
 ## Security Considerations
 
-⚠️ **Important**: This tool is designed for security analysis and testing. Only use it on:
+⚠️ **Important**: This tool is for authorized security testing only.
 
-- Your own databases
-- Databases you have explicit permission to test
-- Staging/development environments
+- Only scan databases you own or have explicit permission to test
+- Use on staging/development environments when possible
+- Never use on production databases without proper authorization
+- Be aware that scanning may trigger rate limits or monitoring alerts
 
-Never use this tool on production databases without proper authorization.
+Unauthorized database scanning may be illegal in your jurisdiction.
 
 ## Development
 
@@ -150,12 +93,19 @@ bun install
 # Run locally
 bun run start
 
+# Run tests
+bun test
+
 # Build
 bun run build
+```
 
-# Test
-bun test
+## License
 
-# Lint
-bun run lint
-```
+supascan is distributed under the [MIT License](LICENCE).
+
+## Links
+
+- **Homepage**: https://github.com/abhishekg999/supascan
+- **Issues**: https://github.com/abhishekg999/supascan/issues
+- **NPM**: https://www.npmjs.com/package/supascan

package/dist/supascan.js

@@ -13931,19 +13931,24 @@ var openInBrowser = (filePath) => {
   const platform = process.platform;
   let command;
   let args;
-  switch (platform) {
-    case "darwin":
-      command = "open";
-      args = [filePath];
-      break;
-    case "win32":
-      command = "start";
-      args = [filePath];
-      break;
-    default:
-      command = "xdg-open";
-      args = [filePath];
-      break;
+  if (Bun.env.BROWSER) {
+    command = Bun.env.BROWSER;
+    args = [filePath];
+  } else {
+    switch (platform) {
+      case "darwin":
+        command = "open";
+        args = [filePath];
+        break;
+      case "win32":
+        command = "start";
+        args = [filePath];
+        break;
+      default:
+        command = "xdg-open";
+        args = [filePath];
+        break;
+    }
   }
   spawn(command, args, { detached: true, stdio: "ignore" });
 };
@@ -14062,11 +14067,22 @@ class SupabaseService {
     }
     const hasData = data && data.length > 0;
     if (hasData) {
-      log.debug(ctx, `Table ${table} is readable with data (EXPOSED)`);
-      return ok({ status: "readable", accessible: true, hasData: true });
+      const { count } = await ctx.client.schema(schema).from(table).select("*", { count: "estimated", head: true });
+      log.debug(ctx, `Table ${table} is readable with ~${count ?? "unknown"} rows (EXPOSED)`);
+      return ok({
+        status: "readable",
+        accessible: true,
+        hasData: true,
+        rowCount: count ?? undefined
+      });
     }
     log.debug(ctx, `Table ${table} returned 0 rows (empty or RLS blocked)`);
-    return ok({ status: "empty", accessible: true, hasData: false });
+    return ok({
+      status: "empty",
+      accessible: true,
+      hasData: false,
+      rowCount: 0
+    });
   }
   static async testTablesRead(ctx, schema, tables) {
     log.debug(ctx, `Testing read access for ${tables.length} tables`);
@@ -14255,15 +14271,11 @@ function toggleApiKey() {
 
 async function saveReport() {
     try {
-        // Generate filename with timestamp and domain
         const domain = '${domain}';
-        const timestamp = new Date().toISOString().split('T')[0]; // YYYY-MM-DD
+        const timestamp = new Date().toISOString().split('T')[0];
         const filename = \`supabase-analysis-\${domain}-\${timestamp}.html\`;
-        
-        // Get the current HTML content
         const htmlContent = document.documentElement.outerHTML;
         
-        // Check if File System Access API is supported
         if ('showSaveFilePicker' in window) {
             const fileHandle = await window.showSaveFilePicker({
                 suggestedName: filename,
@@ -14278,11 +14290,8 @@ async function saveReport() {
             const writable = await fileHandle.createWritable();
             await writable.write(htmlContent);
             await writable.close();
-            
-            // Show success message
             showNotification('Report saved successfully!', 'success');
         } else {
-            // Fallback for browsers that don't support File System Access API
             const blob = new Blob([htmlContent], { type: 'text/html' });
             const url = URL.createObjectURL(blob);
             const a = document.createElement('a');
@@ -14296,17 +14305,13 @@ async function saveReport() {
             showNotification('Report downloaded successfully!', 'success');
         }
     } catch (error) {
-        if (error.name === 'AbortError') {
-            // User cancelled the save dialog
-            return;
-        }
+        if (error.name === 'AbortError') return;
         console.error('Error saving report:', error);
         showNotification('Failed to save report: ' + error.message, 'error');
     }
 }
 
 function showNotification(message, type = 'info') {
-    // Create notification element
     const notification = document.createElement('div');
     notification.className = \`fixed top-4 right-4 px-4 py-3 rounded-lg shadow-lg z-50 font-mono text-sm transition-all duration-300 transform translate-x-full\`;
     
@@ -14321,17 +14326,10 @@ function showNotification(message, type = 'info') {
     notification.textContent = message;
     document.body.appendChild(notification);
     
-    // Animate in
-    setTimeout(() => {
-        notification.classList.remove('translate-x-full');
-    }, 100);
-    
-    // Remove after 3 seconds
+    setTimeout(() => notification.classList.remove('translate-x-full'), 100);
     setTimeout(() => {
         notification.classList.add('translate-x-full');
-        setTimeout(() => {
-            document.body.removeChild(notification);
-        }, 300);
+        setTimeout(() => document.body.removeChild(notification), 300);
     }, 3000);
 }
 
@@ -14342,18 +14340,13 @@ function escapeHtml(text) {
 }
 
 function renderSmartTable(data) {
-    console.log('renderSmartTable called with data:', data);
-    
     if (!data || data.length === 0) {
-        console.log('No data to render');
         return '<div class="p-8 text-center text-gray-400 text-sm font-mono">No data</div>';
     }
     
     const columns = Object.keys(data[0]);
     const maxRows = Math.min(data.length, 100);
     
-    console.log(\`Rendering table with \${columns.length} columns and \${maxRows} rows\`);
-    
     let html = \`
         <div class="overflow-x-auto scrollbar-thin">
             <table class="w-full text-xs font-mono">
@@ -14406,7 +14399,6 @@ function renderSmartTable(data) {
         html += \`<div class="px-3 py-2 text-xs text-slate-500 bg-slate-50 border-t border-slate-200 font-mono">Showing \${maxRows} of \${data.length} rows</div>\`;
     }
     
-    console.log('Table HTML generated successfully');
     return html;
 }
 
@@ -14414,7 +14406,6 @@ function executeQuery(uniqueId) {
     const operation = document.getElementById(\`query-operation-\${uniqueId}\`).value;
     const resultsDiv = document.getElementById(\`query-results-\${uniqueId}\`);
     
-    // Better loading feedback
     resultsDiv.innerHTML = \`
         <div class="p-8 text-center">
             <div class="inline-flex items-center gap-3 text-slate-600 font-mono text-sm">
@@ -14481,23 +14472,16 @@ function executeQuery(uniqueId) {
         }
         
         query.then(({ data, error }) => {
-            console.log('Query result:', { data, error });
-            
             if (error) {
-                console.error('Query error:', error);
                 resultsDiv.innerHTML = \`<div class="p-4 text-red-600 text-sm font-mono bg-red-50 border border-red-200 rounded">Error: \${error.message}</div>\`;
             } else {
-                console.log('Query successful, data length:', data ? data.length : 0);
                 if (data && data.length > 0) {
-                    console.log('Calling renderSmartTable with data:', data);
                     resultsDiv.innerHTML = renderSmartTable(data);
                 } else {
-                    console.log('No data returned');
                     resultsDiv.innerHTML = '<div class="p-8 text-center text-gray-400 text-sm font-mono">No data returned</div>';
                 }
             }
         }).catch((err) => {
-            console.error('Query execution error:', err);
             resultsDiv.innerHTML = \`<div class="p-4 text-red-600 text-sm font-mono bg-red-50 border border-red-200 rounded">Execution error: \${err.message}</div>\`;
         });
         
@@ -14509,7 +14493,6 @@ function executeQuery(uniqueId) {
             function executeRPC(rpcName, uniqueId, schema) {
                 const resultsDiv = document.getElementById(\`rpc-results-\${uniqueId}\`);
                 
-                // Loading feedback
                 resultsDiv.innerHTML = \`
                     <div class="p-8 text-center">
                         <div class="inline-flex items-center gap-3 text-slate-600 font-mono text-sm">
@@ -14520,7 +14503,6 @@ function executeQuery(uniqueId) {
                 \`;
                 
                 try {
-                    // Collect parameters from form inputs
                     const params = {};
                     const paramInputs = document.querySelectorAll(\`[id^="rpc-param-"][id$="-\${uniqueId}"]\`);
                     
@@ -14529,41 +14511,29 @@ function executeQuery(uniqueId) {
                         const value = input.value.trim();
                         
                         if (value !== '') {
-                            // Try to parse as JSON for complex types, otherwise use as string
                             try {
                                 params[paramName] = JSON.parse(value);
                             } catch {
-                                // If JSON parsing fails, use the raw value
                                 params[paramName] = value;
                             }
                         }
                     });
                     
-                    console.log('Executing RPC:', rpcName, 'in schema:', schema, 'with params:', params);
-                    
                     const cleanRpcName = rpcName.startsWith('rpc/') ? rpcName.slice(4) : rpcName;
-                    console.log('Clean RPC name:', cleanRpcName);
-                    
                     const rpcCall = supabase.schema(schema).rpc(cleanRpcName, params);
                     
                     rpcCall.then(({ data, error }) => {
-                        console.log('RPC result:', { data, error });
-                        
                         if (error) {
-                            console.error('RPC error:', error);
                             resultsDiv.innerHTML = \`<div class="p-4 text-red-600 text-sm font-mono bg-red-50 border border-red-200 rounded">Error: \${error.message}</div>\`;
                         } else {
-                            console.log('RPC successful, data:', data);
                             if (data !== null && data !== undefined) {
                                 if (Array.isArray(data)) {
-                                    // If it's an array, render as table
                                     if (data.length > 0) {
                                         resultsDiv.innerHTML = renderSmartTable(data);
                                     } else {
                                         resultsDiv.innerHTML = '<div class="p-8 text-center text-gray-400 text-sm font-mono">RPC returned empty array</div>';
                                     }
                                 } else {
-                                    // If it's a single value, display it nicely
                                     resultsDiv.innerHTML = \`
                                         <div class="p-6">
                                             <div class="bg-slate-50 border border-slate-200 rounded-lg p-4">
@@ -14578,7 +14548,6 @@ function executeQuery(uniqueId) {
                             }
                         }
                     }).catch((err) => {
-                        console.error('RPC execution error:', err);
                         resultsDiv.innerHTML = \`<div class="p-4 text-red-600 text-sm font-mono bg-red-50 border border-red-200 rounded">Execution error: \${err.message}</div>\`;
                     });
                     
@@ -14586,16 +14555,12 @@ function executeQuery(uniqueId) {
                     resultsDiv.innerHTML = \`<div class="text-red-600">Error: \${err.message}</div>\`;
                 }
             }
-            
-            // Show/hide query type sections
+
 document.addEventListener('DOMContentLoaded', function() {
-    // Add event listeners to all operation selects
     document.querySelectorAll('[id^="query-operation-"]').forEach(select => {
         select.addEventListener('change', function() {
             const uniqueId = this.id.replace('query-operation-', '');
-            // Hide all query types for this specific interface
             document.querySelectorAll(\`[id$="-\${uniqueId}"].query-type\`).forEach(el => el.classList.add('hidden'));
-            // Show the selected query type
             const targetId = this.value + '-query-' + uniqueId;
             const target = document.getElementById(targetId);
             if (target) target.classList.remove('hidden');
@@ -14738,10 +14703,13 @@ function APICredentialsDisplay({ url, key }) {
             class: "flex items-center gap-1",
             children: [
               /* @__PURE__ */ $jsxDEV("span", {
+                class: "flex-1 min-w-0",
                 children: [
-                  "Key: ",
+                  "Key:",
+                  " ",
                   /* @__PURE__ */ $jsxDEV("span", {
                     id: "api-key-display",
+                    class: "break-all",
                     children: [
                       key.substring(0, 20),
                       "..."
@@ -14751,7 +14719,7 @@ function APICredentialsDisplay({ url, key }) {
               }, undefined, true, undefined, this),
               /* @__PURE__ */ $jsxDEV("button", {
                 id: "api-key-toggle",
-                class: "px-1 py-0.5 text-xs bg-blue-100 text-blue-800 rounded hover:bg-blue-200 transition-colors",
+                class: "px-1 py-0.5 text-xs bg-blue-100 text-blue-800 rounded hover:bg-blue-200 transition-colors whitespace-nowrap flex-shrink-0",
                 onclick: "toggleApiKey()",
                 children: "Show Full Key"
               }, undefined, false, undefined, this)
@@ -14881,12 +14849,12 @@ function TableRow({
   switch (access?.status) {
     case "readable":
       statusClass = "bg-green-100 text-green-800 border-green-200";
-      statusText = "Data exposed";
+      statusText = `~${access.rowCount ?? "?"} rows exposed`;
       statusIcon = "[+]";
       break;
     case "empty":
       statusClass = "bg-yellow-100 text-yellow-800 border-yellow-200";
-      statusText = "Empty or RLS protected";
+      statusText = "0 rows - empty or RLS";
       statusIcon = "[-]";
       break;
     case "denied":
@@ -15436,8 +15404,11 @@ class HtmlRendererService {
               content: "width=device-width, initial-scale=1.0"
             }, undefined, false, undefined, this),
             /* @__PURE__ */ $jsxDEV("title", {
-              children: "Supabase Database Analysis Report"
-            }, undefined, false, undefined, this),
+              children: [
+                result.summary.domain,
+                " - Security Analysis"
+              ]
+            }, undefined, true, undefined, this),
             /* @__PURE__ */ $jsxDEV("script", {
               src: "https://cdn.tailwindcss.com"
             }, undefined, false, undefined, this),
@@ -15541,7 +15512,7 @@ class HtmlRendererService {
                       children: [
                         /* @__PURE__ */ $jsxDEV("h1", {
                           class: "text-2xl font-bold text-slate-900 mb-1 font-mono",
-                          children: "Supabase Database Analysis"
+                          children: result.summary.domain
                         }, undefined, false, undefined, this),
                         /* @__PURE__ */ $jsxDEV("p", {
                           class: "text-slate-600 font-mono text-sm",
@@ -15624,8 +15595,20 @@ class HtmlRendererService {
               /* @__PURE__ */ $jsxDEV("footer", {
                 class: "mt-12 text-center text-slate-500 text-sm font-mono",
                 children: /* @__PURE__ */ $jsxDEV("p", {
-                  children: "Generated by supascan - Security analysis tool for Supabase"
-                }, undefined, false, undefined, this)
+                  children: [
+                    "Generated by",
+                    " ",
+                    /* @__PURE__ */ $jsxDEV("a", {
+                      href: "https://github.com/abhishekg999/supascan",
+                      target: "_blank",
+                      rel: "noopener noreferrer",
+                      class: "text-supabase-green hover:text-emerald-600 transition-colors underline",
+                      children: "supascan"
+                    }, undefined, false, undefined, this),
+                    " ",
+                    "- Security analysis tool for Supabase"
+                  ]
+                }, undefined, true, undefined, this)
               }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this)
@@ -15719,7 +15702,7 @@ function displayAnalysisResult(result) {
         switch (access?.status) {
           case "readable":
             indicator = import_picocolors2.default.green("[+]");
-            description = import_picocolors2.default.dim("(data exposed)");
+            description = import_picocolors2.default.dim(`(~${access.rowCount ?? "?"} rows exposed)`);
             break;
           case "empty":
             indicator = import_picocolors2.default.yellow("[-]");
@@ -16184,7 +16167,7 @@ var experimentalWarning2 = onlyOnce2(() => {
   }
 });
 // package.json
-var version = "0.0.9";
+var version = "0.1.0";
 
 // version.ts
 var VERSION = version;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "supascan",
-  "version": "0.0.9",
-  "description": "Security analysis tool for Supabase databases",
+  "version": "0.1.0",
+  "description": "Automated security scanner for Supabase databases - detect exposed data, analyze RLS policies, and test RPC functions",
   "license": "MIT",
   "author": "Abhishek Govindarasu",
   "main": "dist/supascan.js",