Security Check

Run before every deploy.

Automated Checks

1. Secrets Scan

# Check for hardcoded secrets in source AND migrations
grep -rn "sk_live\|sk_test\|api_key\s*=\s*['\"][^'\"]\+" src/ supabase/ --include="*.ts" --include="*.tsx" --include="*.sql"
grep -rn "password\s*=\s*['\"][^'\"]\+" src/ supabase/ --include="*.ts" --include="*.tsx" --include="*.sql"
grep -rn "service_role\|supabase_admin\|cron\.\|pg_cron" supabase/migrations/ --include="*.sql" 2>/dev/null

If found: move to env vars or Edge Function secrets. CRON secrets must use vault.secrets, never hardcoded in migrations.

2. Environment Variables

# Check .env files not committed
git status | grep ".env"

If .env tracked: add to .gitignore immediately.

3. Supabase RLS (Enabled + Policy Quality)

# Check all tables have RLS
npx supabase db lint

If RLS disabled: enable RLS before proceeding.

Beyond enabled — check policy quality:

-- Find tables with public SELECT (data exposure risk)
SELECT schemaname, tablename, policyname, cmd, qual
FROM pg_policies WHERE schemaname = 'public';

Flag these patterns:

• Tables with PII (emails, names, tokens) that allow SELECT without auth.uid() = user_id
• OAuth/refresh tokens accessible via public SELECT policy
• Profiles table without row-level restriction (auth.uid() = id)
• Service role keys or admin tokens stored in queryable tables

Supabase auth config checks:

• Email enumeration protection enabled
• MFA available for admin accounts
• Note: Leaked password protection requires Supabase Pro plan ($20/mo) — skip if free tier

4. Input Validation

// Check for unvalidated inputs
grep -rn "req.body\." src/ --include="*.ts" | grep -v "zod\|schema\|validate"

If unvalidated: WARN - add Zod validation.

5. XSS Vectors

grep -rn "dangerouslySetInnerHTML\|innerHTML\|document.write" src/

If found: WARN - sanitize or remove.

Report

Security Check
==============
Secrets:     Pass/Fail
Env files:   Pass/Fail
RLS:         Pass/Fail
Validation:  Pass/Warn
XSS:         Pass/Warn

Result: PASS/FAIL (N warnings)
Ready to deploy: Yes/No

Auto-Fix

For common issues:

• Move secrets -> .env.local
• Add .env* to .gitignore
• Add ALTER TABLE x ENABLE ROW LEVEL SECURITY

Vulnerability Patterns

Quick reference for security vulnerabilities to catch during code review.

Command Injection

GitHub Actions Workflows

Path: .github/workflows/*.yml

Unsafe (user input in run command):

run: echo "${{ github.event.issue.title }}"

Safe (use environment variables):

env:
  TITLE: ${{ github.event.issue.title }}
run: echo "$TITLE"

Risky inputs to watch:

• github.event.issue.title/body
• github.event.pull_request.title/body
• github.event.comment.body
• github.event.commits.*.message
• github.head_ref

Node.js child_process

Unsafe:

exec(`command ${userInput}`)

Safe:

execFile('command', [userInput])

Code Injection

XSS (Cross-Site Scripting)

When to Flag

Flag these:

• User input flowing into dangerous functions
• Hardcoded secrets/credentials
• Missing input validation at system boundaries

Don't flag:

• Internal code with trusted input
• Properly sanitized content
• Test fixtures with mock data

Reference: GitHub Actions Security Guide

Cloud Credential Hygiene (GCP / Vercel / Supabase)

6. API Key & Service Account Audit

# Check for unrestricted or long-lived keys in source
grep -rn "AIza\|GOOG\|ya29\.\|service_account" src/ --include="*.ts" --include="*.tsx" --include="*.json" --include="*.env*"
# Check for keys committed to git history
git log -p --all -S "AIza" --diff-filter=A -- "*.ts" "*.json" 2>/dev/null | head -20

Rules:

• Zero code storage: Never commit API keys or service account JSON. Use Secret Manager or env vars injected at runtime.
• Disable dormant keys: Any key unused for 30+ days should be decommissioned.
• Restrict every API key: Limit to specific APIs (e.g., Maps JS only) and bind to IP/referrer/bundle ID.
• Least privilege: Service accounts get minimum required permissions only. Use IAM recommender to prune unused roles.
• Enforce rotation: Set max key lifespan via org policy. Disable key creation entirely if not needed.

7. Operational Safeguards

Flag if missing:

• Essential contacts configured for security notifications
• Billing anomaly alerts enabled (consumption spike = first sign of compromised credential)
• Budget alerts with notification channels that are actively monitored