Resumen
Uses Scavio to encontrar public Supabase-powered sitios via Google dorks, entonces probes cada app's public tablas for disabled RLS. Designed for seguridad investigadores y bug bounty hunters seguimiento el 2026 wave of Supabase RLS leaks. Outputs un CSV of candidates ese necesita disclosure.
Desencadenador
Cron programar (diario at 3 AM UTC)
Programación
Diario at 3 AM UTC
Pasos del flujo de trabajo
Dork for Supabase apps
Scavio Google search for sitio:*.supabase.co y supabase-js fingerprints in SERP.
Extraer project URLs
Analizar Supabase project dominios y anon keys de el discovered paginas.
Probe public tablas
Attempt leer on comun tabla names (usuarios, perfiles, orders) con anon key.
Marcar open tablas
Any 200 respuesta on un non-RLS-protected tabla obtiene flagged as un candidate leak.
Filtrar duplicates
Dedupe contra un history tabla so previously-reported projects son skipped.
Notificar investigador
Push CSV to S3 y publicacion un resumen conteo to Discord for manual resena.
Implementacion en Python
import os, requests, re
API_KEY = os.environ["SCAVIO_API_KEY"]
H = {"x-api-key": API_KEY}
def find_supabase_apps():
r = requests.post("https://api.scavio.dev/api/v1/search",
headers=H, json={"query": 'inurl:supabase.co "anon public"'}).json()
urls = []
for res in r.get("organic_results", []):
m = re.search(r"https://([a-z0-9]+)\.supabase\.co", res.get("snippet", ""))
if m: urls.append(m.group(0))
return urls
def probe(project_url, anon_key):
r = requests.get(f"{project_url}/rest/v1/users?select=*&limit=1",
headers={"apikey": anon_key}, timeout=10)
return r.status_code == 200 and r.json()
for url in find_supabase_apps():
print(url)Implementacion en JavaScript
const API_KEY = process.env.SCAVIO_API_KEY;
const H = { "x-api-key": API_KEY, "content-type": "application/json" };
async function findApps() {
const r = await fetch("https://api.scavio.dev/api/v1/search", {
method: "POST", headers: H,
body: JSON.stringify({ query: 'inurl:supabase.co "anon public"' })
}).then(r => r.json());
return (r.organic_results || [])
.map(x => (x.snippet || "").match(/https:\/\/[a-z0-9]+\.supabase\.co/))
.filter(Boolean).map(m => m[0]);
}
async function probe(projectUrl, anonKey) {
const r = await fetch(projectUrl + "/rest/v1/users?select=*&limit=1",
{ headers: { apikey: anonKey } });
return r.ok ? await r.json() : null;
}
console.log(await findApps());Plataformas utilizadas
Búsqueda web con grafo de conocimiento, PAA y resúmenes de IA