supabase-audit-auth-signup_skill

Overview

This skill tests whether user signup is open and identifies abuse vectors in the registration process for Supabase projects. It performs pragmatic checks like disposable email acceptance, password policy strength, rate limiting, and information leakage. Results are saved progressively to context and log files and structured evidence is written for each test.

How this skill works

The skill issues controlled signup requests to the Supabase auth endpoint and evaluates responses for acceptance, error messages, and rate limiting behavior. It classifies findings (e.g., open signup, disposable emails allowed, weak passwords accepted, email enumeration) and writes interim results to .sb-pentest-context.json and .sb-pentest-audit.log after each test. Final evidence files are emitted into .sb-pentest-evidence/05-auth-audit/signup-tests/ for later review.

When to use it

• During an authentication security audit of a Supabase project
• When verifying whether signup should be public or restricted
• To check if disposable emails or weak passwords are accepted
• To confirm rate limiting is active on registrations
• Before deployment or when investigating account-creation abuse

Best practices

• Write context and logs progressively: update context file and audit log immediately after each test
• Collect structured evidence files for each test case under the evidence directory
• Use generic response messages on signup to prevent email enumeration
• Enforce email confirmation and stronger password requirements (min 8+, mixed classes)
• Block or flag disposable email domains and apply server-side rate limits

Example use cases

• Confirm whether the project allows anyone to register without invitation
• Test if common disposable email providers can create accounts
• Verify password policies by attempting common weak passwords
• Measure how many signups succeed before a rate limit triggers
• Detect if signup responses reveal whether an email already exists