wehub-resource-sync
1 line
2.4 KiB
JSON
1 line
2.4 KiB
JSON
{"content": "---\nallowed-tools: Read, Write, Edit, Bash\nargument-hint: [audit-scope] | --rls | --permissions | --auth | --api-keys | --comprehensive\ndescription: Conduct comprehensive Supabase security audit with RLS analysis and vulnerability assessment\n---\n\n# Supabase Security Audit\n\nConduct comprehensive Supabase security audit with RLS policy analysis and vulnerability assessment: **$ARGUMENTS**\n\n## Current Security Context\n\n- Supabase access: MCP integration for security analysis and policy review\n- RLS policies: Current Row Level Security implementation and policy effectiveness\n- Auth configuration: !`find . -name \"*auth*\" -o -name \"*supabase*\" | grep -E \"\\\\.(js|ts|json)$\" | head -5` authentication setup\n- API security: Current API key management and access control implementation\n\n## Task\n\nExecute comprehensive security audit with vulnerability assessment and policy optimization:\n\n**Audit Scope**: Use $ARGUMENTS to focus on RLS policies, permission analysis, authentication security, API key management, or comprehensive security review\n\n**Security Audit Framework**:\n1. **RLS Policy Analysis** - Review Row Level Security policies, test policy effectiveness, identify policy gaps, optimize policy performance\n2. **Permission Assessment** - Analyze table permissions, review role-based access, validate permission hierarchies, identify over-privileged access\n3. **Authentication Security** - Review auth configuration, analyze JWT security, validate session management, assess multi-factor authentication\n4. **API Key Management** - Audit API key usage, review key rotation policies, validate key scoping, assess exposure risks\n5. **Data Protection** - Analyze sensitive data handling, review encryption implementation, validate data masking, assess backup security\n6. **Vulnerability Scanning** - Identify security vulnerabilities, assess injection risks, review CORS configuration, validate rate limiting\n\n**Advanced Features**: Automated security testing, policy simulation, vulnerability scoring, compliance checking, security monitoring setup.\n\n**Compliance Integration**: GDPR compliance checking, SOC2 requirements validation, security best practices enforcement, audit trail analysis.\n\n**Output**: Comprehensive security audit report with vulnerability assessments, policy recommendations, security improvements, and compliance validation."} |