What problem does it solve? Client-side JavaScript bundles sometimes leak PostgreSQL connection strings containing database passwords, allowing attackers to bypass Supabase Row Level Security and access the database directly. This Skill scans deployed applications for these exposed credentials and classifies the finding as a P0 critical issue. ## Core Features & Use Cases - Connection String Detection: Scans JavaScript bundles for full PostgreSQL URLs, Supabase pooler (Supavisor) strings, and partial credential exposure such as separate host and password values. - Environment Variable Leak Checks: Identifies dangerous patterns like DATABASE_URL, POSTGRES_URL, or NEXT_PUBLIC_-prefixed secrets bundled into client code. - Structured Evidence & Remediation: Writes findings progressively to .sb-pentest-context.json, logs actions to .sb-pentest-audit.log, and stores redacted evidence in .sb-pentest-evidence/ with step-by-step password rotation guidance. - Use Case: During a pre-production security audit of a Supabase-backed web app, run this Skill to confirm no direct database credentials ship in the client bundle before launch. ## Quick Start Check for database connection strings on https://myapp.example.com.
