supasec 1.0.3 → 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,715 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>SupaSec Security Audit Report</title>
7
- <style>
8
- * {
9
- margin: 0;
10
- padding: 0;
11
- box-sizing: border-box;
12
- }
13
-
14
- body {
15
- font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
16
- background: #f8fafc;
17
- min-height: 100vh;
18
- color: #334155;
19
- line-height: 1.6;
20
- }
21
-
22
- .container {
23
- max-width: 1000px;
24
- margin: 0 auto;
25
- padding: 20px;
26
- }
27
-
28
- /* Header */
29
- .header {
30
- background: white;
31
- padding: 16px 24px;
32
- border-bottom: 1px solid #e2e8f0;
33
- display: flex;
34
- align-items: center;
35
- gap: 12px;
36
- margin: -20px -20px 20px -20px;
37
- }
38
-
39
- .logo {
40
- width: 32px;
41
- height: 32px;
42
- background: linear-gradient(135deg, #3b82f6 0%, #8b5cf6 100%);
43
- border-radius: 8px;
44
- display: flex;
45
- align-items: center;
46
- justify-content: center;
47
- color: white;
48
- font-weight: bold;
49
- }
50
-
51
- .header h1 {
52
- font-size: 20px;
53
- color: #1e293b;
54
- font-weight: 600;
55
- }
56
-
57
- /* Info Banner */
58
- .info-banner {
59
- background: #eff6ff;
60
- border: 1px solid #bfdbfe;
61
- border-radius: 8px;
62
- padding: 16px 20px;
63
- margin-bottom: 24px;
64
- display: flex;
65
- align-items: flex-start;
66
- gap: 12px;
67
- }
68
-
69
- .info-banner .icon {
70
- color: #3b82f6;
71
- font-size: 18px;
72
- margin-top: 2px;
73
- }
74
-
75
- .info-banner h2 {
76
- font-size: 16px;
77
- color: #1e40af;
78
- margin-bottom: 4px;
79
- font-weight: 600;
80
- }
81
-
82
- .info-banner p {
83
- font-size: 14px;
84
- color: #3b82f6;
85
- }
86
-
87
- /* Success Card */
88
- .success-card {
89
- background: white;
90
- border: 1px solid #e2e8f0;
91
- border-radius: 12px;
92
- padding: 24px;
93
- margin-bottom: 24px;
94
- }
95
-
96
- .success-header {
97
- display: flex;
98
- align-items: center;
99
- gap: 12px;
100
- margin-bottom: 16px;
101
- }
102
-
103
- .success-icon {
104
- width: 40px;
105
- height: 40px;
106
- background: #dcfce7;
107
- border-radius: 50%;
108
- display: flex;
109
- align-items: center;
110
- justify-content: center;
111
- color: #16a34a;
112
- font-size: 20px;
113
- }
114
-
115
- .success-title {
116
- font-size: 18px;
117
- font-weight: 600;
118
- color: #1e293b;
119
- }
120
-
121
- .success-title a {
122
- color: #3b82f6;
123
- text-decoration: none;
124
- }
125
-
126
- .success-title a:hover {
127
- text-decoration: underline;
128
- }
129
-
130
- /* Scan Info Grid */
131
- .scan-info-grid {
132
- display: grid;
133
- grid-template-columns: repeat(2, 1fr);
134
- gap: 24px;
135
- }
136
-
137
- .info-group h4 {
138
- font-size: 11px;
139
- text-transform: uppercase;
140
- color: #64748b;
141
- font-weight: 600;
142
- letter-spacing: 0.5px;
143
- margin-bottom: 6px;
144
- }
145
-
146
- .info-group p {
147
- font-size: 14px;
148
- color: #334155;
149
- font-weight: 500;
150
- }
151
-
152
- /* Stats Grid */
153
- .stats-grid {
154
- display: grid;
155
- grid-template-columns: repeat(4, 1fr);
156
- gap: 16px;
157
- margin-bottom: 24px;
158
- }
159
-
160
- .stat-card {
161
- background: white;
162
- border: 1px solid #e2e8f0;
163
- border-radius: 12px;
164
- padding: 20px;
165
- text-align: center;
166
- }
167
-
168
- .stat-label {
169
- font-size: 11px;
170
- text-transform: uppercase;
171
- color: #64748b;
172
- font-weight: 600;
173
- letter-spacing: 0.5px;
174
- margin-bottom: 8px;
175
- }
176
-
177
- .stat-value {
178
- font-size: 32px;
179
- font-weight: 700;
180
- color: #1e293b;
181
- }
182
-
183
- /* Key Findings Section */
184
- .section {
185
- margin-bottom: 24px;
186
- }
187
-
188
- .section-header {
189
- margin-bottom: 16px;
190
- }
191
-
192
- .section-header h2 {
193
- font-size: 20px;
194
- font-weight: 600;
195
- color: #1e293b;
196
- margin-bottom: 4px;
197
- }
198
-
199
- .section-header p {
200
- font-size: 14px;
201
- color: #64748b;
202
- }
203
-
204
- /* Accordion Cards */
205
- .accordion-card {
206
- background: white;
207
- border: 1px solid #e2e8f0;
208
- border-radius: 12px;
209
- margin-bottom: 12px;
210
- overflow: hidden;
211
- }
212
-
213
- .accordion-header {
214
- padding: 16px 20px;
215
- cursor: pointer;
216
- display: flex;
217
- align-items: center;
218
- justify-content: space-between;
219
- gap: 12px;
220
- transition: background 0.2s;
221
- }
222
-
223
- .accordion-header:hover {
224
- background: #f8fafc;
225
- }
226
-
227
- .accordion-title {
228
- display: flex;
229
- align-items: center;
230
- gap: 12px;
231
- flex: 1;
232
- }
233
-
234
- .accordion-title h3 {
235
- font-size: 15px;
236
- font-weight: 600;
237
- color: #1e293b;
238
- }
239
-
240
- .accordion-header p {
241
- font-size: 13px;
242
- color: #64748b;
243
- margin-top: 2px;
244
- }
245
-
246
- .badge {
247
- display: inline-flex;
248
- align-items: center;
249
- gap: 4px;
250
- padding: 4px 10px;
251
- border-radius: 20px;
252
- font-size: 11px;
253
- font-weight: 600;
254
- text-transform: uppercase;
255
- letter-spacing: 0.5px;
256
- }
257
-
258
- .badge-critical {
259
- background: #fee2e2;
260
- color: #dc2626;
261
- }
262
-
263
- .badge-high {
264
- background: #fef3c7;
265
- color: #d97706;
266
- }
267
-
268
- .badge-medium {
269
- background: #fef9c3;
270
- color: #a16207;
271
- }
272
-
273
- .badge-low {
274
- background: #dbeafe;
275
- color: #2563eb;
276
- }
277
-
278
- .badge-info {
279
- background: #dcfce7;
280
- color: #16a34a;
281
- }
282
-
283
- .badge-risk {
284
- background: #fee2e2;
285
- color: #dc2626;
286
- }
287
-
288
- .badge-concern {
289
- background: #fef3c7;
290
- color: #d97706;
291
- }
292
-
293
- .accordion-icon {
294
- color: #94a3b8;
295
- font-size: 12px;
296
- transition: transform 0.2s;
297
- }
298
-
299
- .accordion-content {
300
- display: none;
301
- padding: 0 20px 20px 20px;
302
- border-top: 1px solid #f1f5f9;
303
- }
304
-
305
- .accordion-content.active {
306
- display: block;
307
- }
308
-
309
- .content-section {
310
- margin-bottom: 20px;
311
- }
312
-
313
- .content-section:last-child {
314
- margin-bottom: 0;
315
- }
316
-
317
- .content-section h4 {
318
- font-size: 14px;
319
- font-weight: 600;
320
- color: #1e293b;
321
- margin-bottom: 8px;
322
- }
323
-
324
- .content-section p {
325
- font-size: 14px;
326
- color: #475569;
327
- line-height: 1.6;
328
- }
329
-
330
- .content-section ul {
331
- list-style: none;
332
- padding: 0;
333
- }
334
-
335
- .content-section li {
336
- font-size: 14px;
337
- color: #475569;
338
- padding: 4px 0;
339
- padding-left: 16px;
340
- position: relative;
341
- }
342
-
343
- .content-section li::before {
344
- content: "•";
345
- position: absolute;
346
- left: 0;
347
- color: #94a3b8;
348
- }
349
-
350
- .affected-assets {
351
- background: #f8fafc;
352
- border-radius: 8px;
353
- padding: 12px 16px;
354
- margin-top: 12px;
355
- }
356
-
357
- .affected-assets li {
358
- font-family: 'Monaco', 'Consolas', monospace;
359
- font-size: 13px;
360
- color: #475569;
361
- }
362
-
363
- .tech-details-btn {
364
- display: inline-flex;
365
- align-items: center;
366
- gap: 8px;
367
- margin-top: 16px;
368
- padding: 8px 16px;
369
- background: white;
370
- border: 1px solid #e2e8f0;
371
- border-radius: 6px;
372
- font-size: 13px;
373
- color: #64748b;
374
- cursor: pointer;
375
- transition: all 0.2s;
376
- }
377
-
378
- .tech-details-btn:hover {
379
- background: #f8fafc;
380
- border-color: #cbd5e1;
381
- }
382
-
383
- /* Endpoints Section */
384
- .endpoints-section {
385
- background: white;
386
- border: 1px solid #e2e8f0;
387
- border-radius: 12px;
388
- overflow: hidden;
389
- }
390
-
391
- .endpoints-header {
392
- padding: 20px;
393
- border-bottom: 1px solid #f1f5f9;
394
- }
395
-
396
- .endpoints-header h2 {
397
- display: flex;
398
- align-items: center;
399
- gap: 10px;
400
- font-size: 16px;
401
- font-weight: 600;
402
- color: #1e293b;
403
- margin-bottom: 4px;
404
- }
405
-
406
- .endpoints-header p {
407
- font-size: 13px;
408
- color: #64748b;
409
- }
410
-
411
- .endpoints-table {
412
- width: 100%;
413
- }
414
-
415
- .table-header {
416
- display: grid;
417
- grid-template-columns: 2fr 1fr 1fr 1fr 1fr;
418
- gap: 12px;
419
- padding: 12px 20px;
420
- background: #f8fafc;
421
- border-bottom: 1px solid #e2e8f0;
422
- font-size: 11px;
423
- font-weight: 600;
424
- color: #64748b;
425
- text-transform: uppercase;
426
- letter-spacing: 0.5px;
427
- }
428
-
429
- .table-row {
430
- display: grid;
431
- grid-template-columns: 2fr 1fr 1fr 1fr 1fr;
432
- gap: 12px;
433
- padding: 14px 20px;
434
- border-bottom: 1px solid #f1f5f9;
435
- align-items: center;
436
- font-size: 13px;
437
- }
438
-
439
- .table-row:last-child {
440
- border-bottom: none;
441
- }
442
-
443
- .table-row:hover {
444
- background: #f8fafc;
445
- }
446
-
447
- .endpoint-path {
448
- display: flex;
449
- align-items: center;
450
- gap: 8px;
451
- font-family: 'Monaco', 'Consolas', monospace;
452
- color: #475569;
453
- }
454
-
455
- .expand-icon {
456
- color: #94a3b8;
457
- font-size: 10px;
458
- }
459
-
460
- .status-badge {
461
- display: inline-flex;
462
- padding: 4px 10px;
463
- border-radius: 20px;
464
- font-size: 11px;
465
- font-weight: 600;
466
- }
467
-
468
- .status-at-risk {
469
- background: #fee2e2;
470
- color: #dc2626;
471
- }
472
-
473
- .status-review {
474
- background: #fef3c7;
475
- color: #d97706;
476
- }
477
-
478
- .status-secure {
479
- background: #dcfce7;
480
- color: #16a34a;
481
- }
482
-
483
- .icon-warning {
484
- color: #f59e0b;
485
- }
486
-
487
- .icon-check {
488
- color: #22c55e;
489
- }
490
-
491
- .sensitive-badge {
492
- display: inline-flex;
493
- padding: 4px 10px;
494
- background: #fef3c7;
495
- color: #92400e;
496
- border-radius: 20px;
497
- font-size: 11px;
498
- font-weight: 600;
499
- }
500
-
501
- .sensitive-none {
502
- color: #64748b;
503
- }
504
-
505
- /* Footer */
506
- .footer {
507
- text-align: center;
508
- padding: 40px 20px;
509
- font-size: 12px;
510
- color: #94a3b8;
511
- line-height: 1.8;
512
- }
513
-
514
- @media print {
515
- body { background: white; }
516
- .accordion-content { display: block !important; }
517
- }
518
- </style>
519
- </head>
520
- <body>
521
- <div class="container">
522
- <!-- Header -->
523
- <div class="header">
524
- <div class="logo">S</div>
525
- <h1>supasec</h1>
526
- </div>
527
-
528
-
529
-
530
- <!-- Success Card -->
531
- <div class="success-card">
532
- <div class="success-header">
533
- <div class="success-icon">✓</div>
534
- <div>
535
- <div class="success-title">Scan completed successfully in 0 seconds</div>
536
- <p style="font-size: 14px; color: #3b82f6; margin-top: 4px;">We found <a href="#findings">2 issues to review</a></p>
537
- </div>
538
- </div>
539
-
540
- <div class="scan-info-grid">
541
- <div class="info-group">
542
- <h4>Target</h4>
543
- <p>au***your.app</p>
544
- </div>
545
- <div class="info-group">
546
- <h4>Scan Method</h4>
547
- <p>URL Scan</p>
548
- </div>
549
- <div class="info-group">
550
- <h4>Duration</h4>
551
- <p>0.04 seconds</p>
552
- </div>
553
- <div class="info-group">
554
- <h4>Scan Date</h4>
555
- <p>28/1/2026, 10:49:03 pm</p>
556
- </div>
557
- </div>
558
- </div>
559
-
560
- <!-- Stats Grid -->
561
- <div class="stats-grid">
562
- <div class="stat-card">
563
- <div class="stat-label">Critical</div>
564
- <div class="stat-value" style="color: #dc2626;">0</div>
565
- </div>
566
- <div class="stat-card">
567
- <div class="stat-label">High</div>
568
- <div class="stat-value" style="color: #d97706;">1</div>
569
- </div>
570
- <div class="stat-card">
571
- <div class="stat-label">Medium</div>
572
- <div class="stat-value" style="color: #a16207;">1</div>
573
- </div>
574
- <div class="stat-card">
575
- <div class="stat-label">Low</div>
576
- <div class="stat-value" style="color: #2563eb;">0</div>
577
- </div>
578
- </div>
579
-
580
-
581
- <!-- Key Findings -->
582
- <div class="section" id="findings">
583
- <div class="section-header">
584
- <h2>Key Findings</h2>
585
- <p>High-level security assessment summary for your application</p>
586
- </div>
587
-
588
- <div class="accordion-card">
589
- <div class="accordion-header">
590
- <div style="flex: 1;">
591
- <div class="accordion-title">
592
- <h3>JWT Token Exposed</h3>
593
- <span class="badge badge-risk">⊘ Confirmed Risk</span>
594
- </div>
595
- <p>Found jwt token in javascript content. JWT token detected</p>
596
- </div>
597
- <span class="accordion-icon">▼</span>
598
- </div>
599
- <div class="accordion-content">
600
-
601
- <div class="content-section">
602
- <h4>What we found</h4>
603
- <p>Found jwt token in javascript content. JWT token detected</p>
604
- </div>
605
- <div class="content-section">
606
- <h4>Impact</h4>
607
- <p>Authentication token exposure - unauthorized access to user accounts</p>
608
- </div>
609
- <div class="content-section">
610
- <h4>Our recommendation</h4>
611
- <ul><li>Remove the exposed secret from client-side code immediately</li><li>Move the secret to environment variables on the server</li><li>Regenerate the exposed secret to invalidate the compromised key</li><li>Use only the anon/public key in frontend code</li></ul></div>
612
- <div class="content-section">
613
- <h4>Affected assets</h4>
614
- <ul class="affected-assets"><li>au***your.app:3</li></ul></div>
615
- <div class="tech-details-section" style="margin-top: 16px; padding: 16px; background: #f8fafc; border-radius: 8px; border: 1px solid #e2e8f0;">
616
- <h4 style="font-size: 13px; font-weight: 600; color: #1e293b; margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Technical Details</h4>
617
- <div style="margin-bottom: 12px;">
618
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Exposed Key (masked):</span>
619
- <code style="font-family: 'Monaco', 'Consolas', monospace; font-size: 13px; background: #1e293b; color: #e2e8f0; padding: 8px 12px; border-radius: 6px; display: block; word-break: break-all;">eyJh**************************************************iJ9.</code>
620
- </div>
621
- <div style="margin-bottom: 12px;">
622
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Key Type:</span>
623
- <span style="font-size: 13px; color: #334155; font-weight: 500;">JWT Token</span>
624
- </div>
625
- <div style="margin-bottom: 12px;">
626
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Location:</span><div style="font-family: 'Monaco', 'Consolas', monospace; font-size: 13px; color: #334155;">au***your.app<span style="color: #64748b;">:3</span><span style="color: #94a3b8;">:28</span></div></div>
627
- <div>
628
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Code Snippet:</span>
629
- <pre style="font-family: 'Monaco', 'Consolas', monospace; font-size: 12px; background: #1e293b; color: #e2e8f0; padding: 12px; border-radius: 6px; overflow-x: auto; margin: 0; line-height: 1.5;"><code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.</code></pre>
630
- </div></div>
631
- </div>
632
- </div>
633
- <div class="accordion-card">
634
- <div class="accordion-header">
635
- <div style="flex: 1;">
636
- <div class="accordion-title">
637
- <h3>Supabase Anon Key Exposed</h3>
638
- <span class="badge badge-concern">⚠ Potential Concern</span>
639
- </div>
640
- <p>Found supabase anon key in javascript content. Potential Supabase anon key - verify if properly scop...</p>
641
- </div>
642
- <span class="accordion-icon">▼</span>
643
- </div>
644
- <div class="accordion-content">
645
-
646
- <div class="content-section">
647
- <h4>What we found</h4>
648
- <p>Found supabase anon key in javascript content. Potential Supabase anon key - verify if properly scoped</p>
649
- </div>
650
- <div class="content-section">
651
- <h4>Impact</h4>
652
- <p>Complete database access - attacker can read, write, and delete all data</p>
653
- </div>
654
- <div class="content-section">
655
- <h4>Our recommendation</h4>
656
- <ul><li>Regenerate the service_role key in Supabase dashboard</li><li>Move service_role key to backend environment variables only</li><li>Use anon key for client-side operations</li><li>Review database access logs for unauthorized access</li></ul></div>
657
- <div class="content-section">
658
- <h4>Affected assets</h4>
659
- <ul class="affected-assets"><li>au***your.app:3</li></ul></div>
660
- <div class="tech-details-section" style="margin-top: 16px; padding: 16px; background: #f8fafc; border-radius: 8px; border: 1px solid #e2e8f0;">
661
- <h4 style="font-size: 13px; font-weight: 600; color: #1e293b; margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Technical Details</h4>
662
- <div style="margin-bottom: 12px;">
663
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Exposed Key (masked):</span>
664
- <code style="font-family: 'Monaco', 'Consolas', monospace; font-size: 13px; background: #1e293b; color: #e2e8f0; padding: 8px 12px; border-radius: 6px; display: block; word-break: break-all;">eyJh**************************************************iJ9.</code>
665
- </div>
666
- <div style="margin-bottom: 12px;">
667
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Key Type:</span>
668
- <span style="font-size: 13px; color: #334155; font-weight: 500;">Supabase Anon Key</span>
669
- </div>
670
- <div style="margin-bottom: 12px;">
671
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Location:</span><div style="font-family: 'Monaco', 'Consolas', monospace; font-size: 13px; color: #334155;">au***your.app<span style="color: #64748b;">:3</span><span style="color: #94a3b8;">:28</span></div></div>
672
- <div>
673
- <span style="font-size: 12px; color: #64748b; display: block; margin-bottom: 4px;">Code Snippet:</span>
674
- <pre style="font-family: 'Monaco', 'Consolas', monospace; font-size: 12px; background: #1e293b; color: #e2e8f0; padding: 12px; border-radius: 6px; overflow-x: auto; margin: 0; line-height: 1.5;"><code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiJ9.</code></pre>
675
- </div></div>
676
- </div>
677
- </div></div>
678
-
679
-
680
- <!-- Endpoints Section -->
681
- <div class="endpoints-section">
682
- <div class="endpoints-header">
683
- <h2>
684
- <span style="font-size: 20px;">🗄</span>
685
- Endpoints
686
- </h2>
687
- <p>No API endpoints were detected during this scan.</p>
688
- </div>
689
- <div style="padding: 40px 20px; text-align: center; color: #64748b;">
690
- <p style="font-size: 14px;">Endpoints are detected when scanning Supabase projects with accessible REST API.</p>
691
- <p style="font-size: 13px; margin-top: 8px;">Try scanning with --project-url and --anon-key options for deeper analysis.</p>
692
- </div>
693
- </div>
694
-
695
- <!-- Footer -->
696
- <div class="footer">
697
- <p>Supasec is an independent service and is not affiliated, associated, authorized, endorsed by, or in any way officially connected with Supabase Inc.</p>
698
- <p>"Supabase" and related marks are trademarks of Supabase Inc. Any mention is for descriptive purposes only and does not imply any partnership.</p>
699
- <p style="margin-top: 16px; color: #64748b;">Generated by Supasec • Report ID: scan_2026-01-28T17-19-03</p>
700
- </div>
701
- </div>
702
-
703
- <script>
704
- // Accordion functionality
705
- document.querySelectorAll('.accordion-header').forEach(header => {
706
- header.addEventListener('click', () => {
707
- const content = header.nextElementSibling;
708
- const icon = header.querySelector('.accordion-icon');
709
- content.classList.toggle('active');
710
- icon.style.transform = content.classList.contains('active') ? 'rotate(180deg)' : 'rotate(0deg)';
711
- });
712
- });
713
- </script>
714
- </body>
715
- </html>