Last week I was trying to harden my Supabase database. I kept going back and forth with Claude, “is this RLS policy correct?”, “can anonymous users still read this table?”, “what about storage buckets?” Halfway through, I realized I was repeating the same security checklist across every project. So I turned the entire process into a Claude Skill. Supabase Sentinel (I could not think of a better name, sorry) is an open-source security auditor for Supabase projects. Drop it into Claude Code or Cursor, say “audit my Supabase project using supabase-sentinel skill” and it: → Scans your codebase for exposed service_role keys → Introspects your schema and all RLS policies → Matches against 27 vulnerability patterns sourced from CVE-2025-48757 and 10 published security studies → Dynamically probes your API to test what attackers can actually do (safely — zero data modified) → Generates a scored report with exact fix SQL for every finding → Optionally sets up a GitHub Action for continuous monitoring Fully open-source, MIT licensed. No signups, no SaaS. Just markdown files that make your AI coding assistant smarter about security. “I have a group of testers! They’re called the users” No, it doesn’t work, stop memeing. If you’re shipping on Supabase, run this before your users find out the hard way. It’s simple, quick to set up, and gets the work done. Link: https://github.com/Farenhytee/supabase-sentinel submitted by /u/Farenhytee
Originally posted by u/Farenhytee on r/ClaudeCode