supasec 1.0.1 → 1.0.3

package/reports/supasec-ex-mple-com-2026-01-28-17-14-52.json

@@ -0,0 +1,229 @@
+{
+  "scan_metadata": {
+    "tool": "supasec",
+    "version": "1.0.0",
+    "scan_id": "scan_2026-01-28T17-14-52",
+    "target_url": "ex*mple.com/",
+    "scan_date": "2026-01-28T17:14:52.023Z",
+    "scan_duration_seconds": 0.007,
+    "scanner_mode": "url"
+  },
+  "project_info": {
+    "tables_count": 0,
+    "rpcs_count": 0,
+    "storage_buckets": 0,
+    "auth_providers": [],
+    "edge_functions": 0
+  },
+  "summary": {
+    "total_issues": 2,
+    "critical": 0,
+    "high": 1,
+    "medium": 1,
+    "low": 0,
+    "info": 0,
+    "passed_checks": 2,
+    "overall_grade": "B",
+    "overall_score": 85
+  },
+  "findings": [
+    {
+      "finding_id": "SEC-001",
+      "timestamp": "2026-01-28T17:14:52.026Z",
+      "severity": "MEDIUM",
+      "category": "secrets",
+      "subcategory": "supabase",
+      "title": "Supabase Anon Key Exposed",
+      "description": "Found supabase anon key in javascript content. Potential Supabase anon key - verify if properly scoped",
+      "location": {
+        "file": "https://ex*****.com/",
+        "line": 3,
+        "column": 28
+      },
+      "evidence": {
+        "code_snippet": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.",
+        "matched_pattern": "Supabase Anon Key",
+        "sample_data": {
+          "masked": "eyJh**************************************************iJ9.",
+          "original": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9."
+        },
+        "key_type": "supabase",
+        "line_number": 3,
+        "column_number": 28
+      },
+      "impact": {
+        "severity_score": 5,
+        "description": "Complete database access - attacker can read, write, and delete all data",
+        "affected_resources": [
+          "application",
+          "database",
+          "api"
+        ],
+        "compliance_violations": [
+          "SOC2-CC6.1",
+          "GDPR-Article-32"
+        ]
+      },
+      "remediation": {
+        "summary": "Remove supabase anon key from client-side code",
+        "priority": "HIGH",
+        "effort": "LOW",
+        "steps": [
+          {
+            "order": 1,
+            "action": "Regenerate the service_role key in Supabase dashboard",
+            "command": "Dashboard > Settings > API > Regenerate service_role key"
+          },
+          {
+            "order": 2,
+            "action": "Move service_role key to backend environment variables only",
+            "code": "// Server-side only\nconst supabase = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY)"
+          },
+          {
+            "order": 3,
+            "action": "Use anon key for client-side operations",
+            "code": "// Client-side\nconst supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY)"
+          },
+          {
+            "order": 4,
+            "action": "Review database access logs for unauthorized access"
+          }
+        ],
+        "auto_fixable": false
+      },
+      "references": [
+        {
+          "title": "Supabase API Keys Documentation",
+          "url": "https://supabase.com/docs/guides/api#api-keys"
+        },
+        {
+          "title": "CWE-798: Use of Hard-coded Credentials",
+          "url": "https://cwe.mitre.org/data/definitions/798.html"
+        }
+      ],
+      "false_positive_likelihood": "LOW",
+      "confidence": 0.95
+    },
+    {
+      "finding_id": "SEC-003",
+      "timestamp": "2026-01-28T17:14:52.027Z",
+      "severity": "HIGH",
+      "category": "secrets",
+      "subcategory": "auth",
+      "title": "JWT Token Exposed",
+      "description": "Found jwt token in javascript content. JWT token detected",
+      "location": {
+        "file": "https://ex*****.com/",
+        "line": 3,
+        "column": 28
+      },
+      "evidence": {
+        "code_snippet": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.",
+        "matched_pattern": "JWT Token",
+        "sample_data": {
+          "masked": "eyJh**************************************************iJ9.",
+          "original": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9."
+        },
+        "key_type": "auth",
+        "line_number": 3,
+        "column_number": 28
+      },
+      "impact": {
+        "severity_score": 8,
+        "description": "Authentication token exposure - unauthorized access to user accounts",
+        "affected_resources": [
+          "application",
+          "database",
+          "api"
+        ],
+        "compliance_violations": [
+          "SOC2-CC6.1",
+          "OWASP-A02-2021"
+        ]
+      },
+      "remediation": {
+        "summary": "Remove jwt token from client-side code",
+        "priority": "HIGH",
+        "effort": "LOW",
+        "steps": [
+          {
+            "order": 1,
+            "action": "Remove the exposed secret from client-side code immediately",
+            "code": "// Remove hardcoded key\nconst supabaseKey = process.env.SUPABASE_KEY;"
+          },
+          {
+            "order": 2,
+            "action": "Move the secret to environment variables on the server",
+            "command": "export API_KEY=your_key_here"
+          },
+          {
+            "order": 3,
+            "action": "Regenerate the exposed secret to invalidate the compromised key",
+            "command": "Regenerate in service dashboard"
+          },
+          {
+            "order": 4,
+            "action": "Use only the anon/public key in frontend code",
+            "code": "const supabase = createClient(url, process.env.SUPABASE_ANON_KEY)"
+          }
+        ],
+        "auto_fixable": false
+      },
+      "references": [
+        {
+          "title": "OWASP Authentication Cheat Sheet",
+          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
+        }
+      ],
+      "false_positive_likelihood": "LOW",
+      "confidence": 0.95
+    }
+  ],
+  "passed_checks": [
+    {
+      "check_id": "SEC-HTTPS-001",
+      "category": "transport",
+      "title": "HTTPS Enforced",
+      "description": "All connections use HTTPS/TLS 1.2+"
+    },
+    {
+      "check_id": "AUTH-EMAIL-001",
+      "category": "auth",
+      "title": "Email Verification Enabled",
+      "description": "New users must verify email before access"
+    }
+  ],
+  "grading": {
+    "overall_grade": "B",
+    "overall_score": 85,
+    "category_scores": {},
+    "scoring_methodology": {
+      "base_score": 100,
+      "critical_deduction": -20,
+      "high_deduction": -10,
+      "medium_deduction": -5,
+      "low_deduction": -2
+    },
+    "grade_thresholds": {
+      "A": 90,
+      "B": 80,
+      "C": 70,
+      "D": 60,
+      "F": 0
+    },
+    "improvement_priority": [
+      "Fix SEC-003: JWT Token Exposed"
+    ]
+  },
+  "recommendations": {
+    "immediate_actions": [],
+    "security_best_practices": [
+      "Audit all environment variables and secrets management"
+    ],
+    "next_steps": [
+      "Run: supasec fix --interactive",
+      "Schedule weekly scans: supasec watch --interval 604800",
+      "Add to CI/CD: see https://github.com/yourusername/supasec#cicd"
+    ]
+  }
+}