Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

supabase/supabase-js

              master @ 463fa91
            

Fixes

CVEs

HIGH

Peak severity

32.1%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

GoTrueClient: most-fixed (9 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Misconfigured fallbacks to global client authorization headers, flawed CAPTCHA parameter serialization (using camelCase instead of snake_case), and incomplete OpenID Connect state evaluations bypass critical validation filters.

Information Disclosure: Next.js standard behavior may aggressively cache fetch results. Without forcing the 'no-store' option on authentication-related HTTP calls, sensitive session credentials risk exposure via regional shared cache stores.

Auth Bypass: Failure to rigorously validate table filters in realtime subscription callback dispatches allows database events occurring on unintended or restricted tables to trigger listeners.