Scan Next.js + Supabase authentication and authorization security issues
Scans authentication and authorization security issues in Next.js + Supabase projects.
If $ARGUMENTS is provided, scan only that path. Otherwise scan the entire project.
Always exclude build artifacts: node_modules/, .next/, dist/, build/.
{,src/}middleware.{ts,js} — locate middleware filels to check for app/, src/app/, pages/ (detect router type){app,src/app}/**/route.{ts,js}, {pages,src/pages}/api/**/*.{ts,js}"use server" (file names only) — Server Action filescreateClient|createServerClient — Supabase client usage{lib,src/lib,utils,src/utils}/**/supabase*.{ts,js} — central client factoriesmiddleware.ts matcher patterns and identify protected routes.@modal/) and Intercepting Routes ((.), (..))."use server" to identify Server Actions.getUser(), auth(), requireAuth, withAuth, createServerClient(...).auth.getUser(). Custom wrappers are traced up to 1 level deep; beyond that, report as "manual verification required".route.ts / pages/api/*.ts without auth verification — Critical.getSession() does not re-verify the JWT on the server, making it unsuitable for authentication decisions. Use getUser() instead.getSession() is used solely for UI display (e.g., showing user name) and not for auth decisions.service_role key is reachable from a route without auth verification.service_role and check auth state of importing files."use server" functions use validation libraries: zod, valibot, yup, next-safe-action.FormData.get() values are passed directly to the DB without validation.cookies() to Client Component props — Warning..select('*') to Client Component — Warning.unstable_cache or React cache() caching per-user data — may leak to other users.revalidatePath / revalidateTag called from unauthenticated Server Actions — DoS vector.@supabase/ssr's createServerClient.@supabase/ssr v0.5+ handles cookie settings internally. Skip manual cookie checks for that version. For earlier versions, verify httpOnly, secure, sameSite settings.@supabase/ssr version from package.json.redirect(variable) or router.push(variable) patterns after login/logout. Skip if the argument is a string literal.?next=, ?redirect=, etc.) used for redirection without validation.Follow suppression rules in CLAUDE.md.
Follow the common output format in CLAUDE.md.