Menu

Individual skill

launch-security-check

0upvotes

Quick pre-launch security check for Next.js + Supabase + Stripe apps. Finds public tables without row level security, service-role or secret keys reaching client code (NEXT_PUBLIC_ variables, 'use client' files), and Stripe webhook handlers without constructEvent signature verification. Use when the user asks for a launch, ship or go-live security check, or a quick security pass on a Supabase/Stripe app.

skills/launch-security-check/SKILL.md

Read pinned source

Source commit 8a7193870ac3ea0027fb8735b48d63baf2e01f75

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
Yes
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
0
Repository last updated
Oct 17, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# launch-security-check

Read-only review. Don't edit files unless the user asks for the fixes afterwards. Every grep hit is a lead: open the file and confirm it before you report it.

## L1: Public tables without RLS (critical)
Only tables in the `public` schema (or another schema you expose through the Data API) count. Ignore `private.`, `auth.` and other schemas. Search across lines (multiline), case-insensitive, because SQL statements can wrap.
1. Grep `supabase/migrations/` for `create\s+table\s+(if\s+not\s+exists\s+)?(public\.)?"?([a-z_0-9]+)"?` and list the public table names. Skip names qualified with another schema.
2. Grep the same folder for `alter\s+table\s+(only\s+)?(public\.)?"?([a-z_0-9]+)"?\s+enable\s+row\s+level\s+security`.
3. A table from step 1 with no match in step 2 is a finding. Also grep for `disable\s+row\s+level\s+security`: any hit on a public table is a finding.
Fix: `alter table public.<t> enable row level security;` plus policies for the access the app needs. For the full RLS and grants review (R1–R6), use `supabase-rls-review`.

## L2: Service-role or secret keys reaching client code (critical)
1. Grep app code (not `*.md`) for `NEXT_PUBLIC_[A-Z0-9_]*(SERVICE_ROLE|SECRET)`. `NEXT_PUBLIC_` values are bundled into the browser, so any hit is a finding.
2. Grep for client files (pattern `^\s*['"]use client['"]`), then read the top of each one and confirm the directive is the first statement. Comments may come before it. In those files, grep for `service_role|SERVICE_ROLE_KEY|supabase/admin|createAdminClient|supabaseAdmin|STRIPE_SECRET_KEY`. Any hit is a finding.
Back to top