HOW REP+ HELPED ME IDENTIFY A CRITICAL SUPABASE JWT EXPOSURE

Summary from the TLDR InfoSec newsletter

A security researcher discovered a critical Supabase misconfiguration in which an anonymous JWT embedded in client-side JavaScript granted read access to password_reset_tokens and 34 other tables due to missing Row Level Security (RLS) policies. The exposure of 272 password reset tokens and plaintext passwords enabled a full account takeover, demonstrating how publicly intended anonymous keys become dangerous when RLS is improperly configured. Security teams should audit Supabase deployments by enumerating REST endpoints with anon tokens and validating RLS enforcement across all exposed tables.