Supabase Report Compare

yoanbernabeu/supabase-pentest-skills/skills/report/supabase-report-compare

作者 yoanbernabeu0f9612276b49f241584f9d779767e35ae519875a无许可证收录于 2026年10月9日更新于 2026年10月9日

Compare two security audit reports to track remediation progress and identify new vulnerabilities.

仅含说明Security
AI 生成的概览

比较两份 Supabase 安全审计报告，跟踪修复进度、遗留问题和新出现的漏洞。

功能
该技能接收同一项目的两份 Markdown 格式安全审计报告，按编号、组件加标题或位置匹配发现项。它将每项发现归类为已修复、仍存在或新增，并计算评分变化、修复率和平均修复时间。它会生成格式化的对比报告，包括名为 supabase-audit-comparison.md 的 Markdown 文件和 JSON 上下文块，并可扩展到三份及以上报告的趋势分析。
适用场景
适用于修复漏洞后验证修复效果、定期安全审查、长期跟踪安全状况或识别回归问题。适合已为同一项目保留带日期审计报告的团队。
运行要求
同一项目的两份 Markdown 格式安全审计报告；无需脚本、软件包或凭据。

Report Comparison

This skill compares two security audit reports to track progress over time.

When to Use This Skill

  • After fixing vulnerabilities, to verify remediation
  • For periodic security reviews
  • To track security posture over time
  • To identify regression (new vulnerabilities)

Prerequisites

  • Two audit reports in Markdown format
  • Reports should be from the same project

Usage

Basic Comparison

Compare security reports old-report.md and new-report.md

With Specific Paths

Compare reports/audit-v1.md with reports/audit-v2.md

Output Format

═══════════════════════════════════════════════════════════ SECURITY AUDIT COMPARISON═══════════════════════════════════════════════════════════
 Previous Audit: January 15, 2025 Current Audit:  January 31, 2025 Days Between:   16 days
 ───────────────────────────────────────────────────────── Score Comparison ─────────────────────────────────────────────────────────
 Previous Score: 35/100 (Grade: D) Current Score:  72/100 (Grade: C) Improvement:    +37 points ⬆️
 ┌────────────────────────────────────────────────────────┐ │ Score Progress                                         │ │                                                        │ │  100 ┤                                                 │ │   80 ┤                              ████████ 72       │ │   60 ┤                              ████████          │ │   40 ┤ ████████ 35                  ████████          │ │   20 ┤ ████████                     ████████          │ │    0 ┴─────────────────────────────────────────────── │ │        Jan 15                       Jan 31            │ └────────────────────────────────────────────────────────┘
 ───────────────────────────────────────────────────────── Findings Summary ─────────────────────────────────────────────────────────
 | Status      | P0  | P1  | P2  | Total | |-------------|-----|-----|-----|-------| | Previous    | 3   | 4   | 5   | 12    | | Current     | 0   | 2   | 4   | 6     | | Fixed       | 3   | 2   | 2   | 7     | | New         | 0   | 0   | 1   | 1     |
 ───────────────────────────────────────────────────────── Fixed Vulnerabilities ✅ ─────────────────────────────────────────────────────────
 P0 (Critical) - ALL FIXED! 🎉
 ✅ P0-001: Service Role Key Exposed    Status: FIXED    Resolution: Key rotated, removed from client code    Fixed on: January 16, 2025
 ✅ P0-002: Database Backups Publicly Accessible    Status: FIXED    Resolution: Bucket made private, files deleted    Fixed on: January 16, 2025
 ✅ P0-003: Admin Function Privilege Escalation    Status: FIXED    Resolution: Added admin role verification    Fixed on: January 17, 2025
 P1 (High) - 2 of 4 Fixed
 ✅ P1-001: Email Confirmation Disabled    Status: FIXED    Resolution: Email confirmation now required    Fixed on: January 20, 2025
 ✅ P1-002: IDOR in get-user-data Function    Status: FIXED    Resolution: Added user ownership verification    Fixed on: January 18, 2025
 P2 (Medium) - 2 of 5 Fixed
 ✅ P2-001: Weak Password Policy    Status: FIXED    Resolution: Minimum length increased to 10    Fixed on: January 22, 2025
 ✅ P2-003: Disposable Emails Accepted    Status: FIXED    Resolution: Email validation added    Fixed on: January 25, 2025
 ───────────────────────────────────────────────────────── Remaining Vulnerabilities ⚠️ ─────────────────────────────────────────────────────────
 P1 (High) - 2 Remaining
 🟠 P1-003: User Enumeration via Timing Attack    Status: OPEN (16 days)    Priority: Address this week    Note: Was in previous report, not yet fixed
 🟠 P1-004: Admin Channel Publicly Accessible    Status: OPEN (16 days)    Priority: Address this week
 P2 (Medium) - 3 Remaining
 🟡 P2-002: Wildcard CORS Origin    Status: OPEN (16 days)
 🟡 P2-004: Verbose Error Messages    Status: OPEN (16 days)
 🟡 P2-005: Rate Limiting Not Enforced on Functions    Status: OPEN (16 days)
 ───────────────────────────────────────────────────────── New Vulnerabilities 🆕 ─────────────────────────────────────────────────────────
 P2 (Medium) - 1 New Issue
 🆕 P2-006: New Storage Bucket Without RLS    Severity: 🟡 P2    Component: Storage    Description: New bucket 'user-uploads' created without                 RLS policies. Currently empty but will                 need policies before production use.    First Seen: January 31, 2025
 ───────────────────────────────────────────────────────── Progress Analysis ─────────────────────────────────────────────────────────
 Remediation Rate: 58% (7 of 12 fixed)
 By Severity: ├── P0 (Critical): 100% fixed ✅ ├── P1 (High): 50% fixed └── P2 (Medium): 40% fixed
 Time to Fix (Average): ├── P0: 1.3 days (excellent) ├── P1: 3.5 days (good) └── P2: 5.5 days (acceptable)
 Regression: 1 new issue introduced             (lower severity, acceptable)
 ───────────────────────────────────────────────────────── Recommendations ─────────────────────────────────────────────────────────
 1. CONTINUE PROGRESS    Great work fixing all P0 issues! Focus now on    remaining P1 issues:    - User enumeration timing attack    - Admin broadcast channel
 2. ADDRESS NEW ISSUE    Configure RLS on 'user-uploads' bucket before    it's used in production.
 3. SCHEDULE FOLLOW-UP    Recommend another audit in 14 days to verify    remaining fixes.
 ───────────────────────────────────────────────────────── Trend Analysis ─────────────────────────────────────────────────────────
 If you have 3+ reports, trend analysis is available:
 | Date       | Score | P0 | P1 | P2 | Total | |------------|-------|----|----|----| ------| | 2024-12-01 | 28    | 4  | 5  | 6  | 15    | | 2025-01-15 | 35    | 3  | 4  | 5  | 12    | | 2025-01-31 | 72    | 0  | 2  | 4  | 6     |
 Trend: Improving ⬆️
═══════════════════════════════════════════════════════════

Comparison Logic

Finding Matching

Findings are matched between reports using:

  1. ID match — Same P0-001, P1-002, etc.
  2. Component + Title match — Same issue description
  3. Location match — Same file/line/endpoint

Status Determination

PreviousCurrentStatus
PresentAbsentFixed ✅
PresentPresentRemaining ⚠️
AbsentPresentNew 🆕
AbsentAbsentN/A

Score Calculation

Change = Current Score - Previous Score
Positive change = Improvement ⬆️Negative change = Regression ⬇️No change = Stable ➡️

Context Output

json
{  "comparison": {    "previous_date": "2025-01-15",    "current_date": "2025-01-31",    "previous_score": 35,    "current_score": 72,    "score_change": 37,    "findings": {      "previous_total": 12,      "current_total": 6,      "fixed": 7,      "remaining": 5,      "new": 1    },    "by_severity": {      "P0": { "previous": 3, "current": 0, "fixed": 3, "new": 0 },      "P1": { "previous": 4, "current": 2, "fixed": 2, "new": 0 },      "P2": { "previous": 5, "current": 4, "fixed": 2, "new": 1 }    },    "remediation_rate": 0.58,    "trend": "improving"  }}

Report Output

The comparison generates supabase-audit-comparison.md:

markdown
# Security Audit Comparison Report
## Summary
| Metric | Previous | Current | Change ||--------|----------|---------|--------|| Score | 35/100 | 72/100 | +37 ⬆️ || P0 Issues | 3 | 0 | -3 ✅ || P1 Issues | 4 | 2 | -2 ✅ || P2 Issues | 5 | 4 | -1 ✅ || Total | 12 | 6 | -6 ✅ |
## Fixed Issues (7)
[Detailed list of fixed issues...]
## Remaining Issues (5)
[Detailed list of remaining issues...]
## New Issues (1)
[Detailed list of new issues...]
## Recommendations
[Action items based on comparison...]

Multiple Report Comparison

For trend analysis across 3+ reports:

Compare trend across reports/audit-*.md

Output includes:

  • Score trend graph
  • Issue count over time
  • Average time to fix
  • Recurring issues identification

Best Practices

Naming Convention

reports/├── supabase-audit-2024-12-01.md├── supabase-audit-2025-01-15.md├── supabase-audit-2025-01-31.md└── supabase-audit-comparison-2025-01-31.md

Regular Audits

FrequencyPurpose
After fixesVerify remediation
MonthlyCatch regressions
Before releasesPre-production check
After incidentsPost-incident review

Tracking Progress

  1. Keep all reports in version control
  2. Link to issue tracker (GitHub, Jira)
  3. Include in sprint planning
  4. Report to stakeholders

Related Skills

  • supabase-report — Generate the reports to compare
  • supabase-pentest — Run full audit
  • supabase-help — Quick reference

来源与署名

来源：yoanbernabeu/supabase-pentest-skills位于skills/report/supabase-report-compare提交0f96122

许可证： 无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 yoanbernabeu/supabase-pentest-skills 的技能

Supabase Extract Jwt

yoanbernabeu

从客户端代码、Cookie 和存储模式中提取并解码与 Supabase 相关的 JWT。

Security2026年10月9日

Supabase Pentest

yoanbernabeu

编排分阶段的 Supabase 安全审计，涵盖检测、密钥提取到报告生成，并跟踪证据。

Security2026年10月9日

Supabase Audit Tables Read

yoanbernabeu

测试 Supabase 暴露表的读取权限，以验证数据暴露情况和 RLS 有效性。

Security2026年10月9日

Supabase Help

yoanbernabeu

列出 Supabase 安全审计技能、命令、工作流程与报告产物的参考指南。

Security2026年10月9日

Supabase Detect

yoanbernabeu

通过扫描客户端代码、端点和响应头，检测 Web 应用是否使用 Supabase。

Security2026年10月9日

Supabase Audit Realtime

yoanbernabeu

审计 Supabase Realtime WebSocket 频道，检查未授权订阅与数据暴露。

Security2026年10月9日

更多Security技能

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Google Cloud Scc Remediation

google

精选

指导修复 Google Cloud Security Command Center 发现项，提供需用户批准的方案与参考手册。

Security21K昨天更新

Google Cloud Recipe Auth

google

精选

指导用户、服务账号和工作负载如何对 Google Cloud 服务与 API 进行身份验证和授权。

Security21K昨天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K昨天更新