skills.rest
AIBiz-Automatyzacje
AIBiz-AutomatyzacjeCOMMUNITY
Explore all skills by this author →
GitHub

security

Audits React Native, Expo, and Supabase codebases for security vulnerabilities across six scan categories.

16|1|Updated May 5, 2026
Search Tags:#owasp#penetration testing#security audit#supabase#react native#expo#rls policies
One-click install
npx skills add https://github.com/AIBiz-Automatyzacje/workspace-template-mobile --skill security-aibiz-automatyzacje
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/AIBiz-Automatyzacje/workspace-template-mobile/tree/main/.claude/skills/security
Command: npx skills add https://github.com/AIBiz-Automatyzacje/workspace-template-mobile --skill security-aibiz-automatyzacje

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Mobile apps built with React Native, Expo, and Supabase expose a public app bundle, run on untrusted devices, and accept input through deep links, QR codes, and push notifications, yet most teams lack a systematic way to audit these attack surfaces before release. ## Core Features & Use Cases - Six-Scan Audit Protocol: Systematically checks input validation (Zod), SQL/RLS safety, mobile surface (SecureStore, deep links, WebView), auth/authz (JWT, getClaims vs getSession), sensitive data exposure (EXPO_PUBLIC_* secrets, PII in logs), and OWASP Mobile Top 10 plus OWASP Top 10:2025 compliance. - Classified Findings Report: Produces a structured report with CRITICAL/HIGH/MEDIUM/LOW severity ratings, a risk matrix, and a remediation roadmap with code-level fixes. - Reference Guides: Includes Supabase RLS policy patterns, Edge Function JWT verification templates, and OWASP 2025 category mappings with checklists. - Use Case: Before submitting an Expo app to the App Store, run the audit to catch a service_role key leaked into the bundle, missing RLS policies on a new table, or unvalidated deep link parameters. ## Quick Start Run a security audit of this Expo and Supabase project before release and report all findings with severity ratings and fixes.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a React Native Expo app for security vulnerabilities?▼

Run a six-scan audit covering input validation with Zod, SQL and RLS safety, mobile surface risks like SecureStore and deep links, auth and authorization checks, sensitive data exposure, and OWASP compliance. Each finding is classified as CRITICAL, HIGH, MEDIUM, or LOW with remediation steps.

How do I secure Supabase RLS policies in a mobile app?▼

Enable row level security on every table and write policies for SELECT, INSERT, UPDATE, and DELETE using (SELECT auth.uid()) rather than auth.email(). Never base authorization on user_metadata, which users can edit; use app_metadata or a dedicated roles table instead.

Should I use getSession or getUser for server-side auth in Supabase Edge Functions?▼

Use getClaims() or getUser() for server-side authorization, never getSession(), which only reads local token state without verification. getClaims() verifies tokens locally via JWKS on projects with asymmetric JWT keys, while getUser() contacts the Auth server and works as a fallback.

Can I store secrets in EXPO_PUBLIC_ environment variables?▼

No. Anything prefixed with EXPO_PUBLIC_ is embedded in the public app bundle and extractable by anyone who downloads the app. Only anon keys and public URLs belong there; paid API keys and the Supabase service_role key must stay in Edge Functions or backend environment variables.

Why is AsyncStorage unsafe for session tokens in React Native?▼

AsyncStorage stores data as plaintext on disk, readable on rooted or jailbroken devices. Session tokens and sensitive data should use expo-secure-store, which backs onto iOS Keychain and Android Keystore, and the Supabase client should use a SecureStore storage adapter.

Does DOMPurify work for sanitizing HTML in React Native?▼

No. DOMPurify requires a DOM, which React Native lacks, so calling sanitize in RN runtime throws a TypeError. Sanitize user-generated HTML server-side in an Edge Function, or avoid rendering HTML entirely and treat WebView content as untrusted input.

Related Skills

Explore More Software Engineering Skills→
MeechYourGoalsMeechYourGoals
2

chravel-supabase-rls

Audit and implement Supabase Row-Level Security policies with auth.uid().

Community
Advanced
coreymaypraycoreymaypray
1

security-engineer

Audits Supabase RBAC policies, Edge Functions, Stripe webhooks, and secret handling.

Community
Advanced
BuilderIOBuilderIO
11

mobile-testing

Build, install, and validate iOS and Android app workflows with Maestro.

Official
Advanced
jd-opensourcejd-opensource
299

pentest-mobile-app

Automate Android and iOS mobile app security testing with Frida and MobSF.

Official
Advanced