Bad Vibes

CLI tool that detects risky Supabase data access configurations exposed through vibe-coded web apps.

What it does

• Discovers Supabase project refs and API keys embedded in web pages and JavaScript bundles
• Fetches and analyzes Supabase OpenAPI schema exports
• Probes live table endpoints to check what data is actually readable, writable, updateable, and deletable
• Flags risky patterns: exposed tokens, email fields, broad write surfaces, missing auth docs
• Compares local schema exports against live projects to detect drift

Install

python3 -m pip install -e .

Discover Supabase config from a web page

Fetches a page, scans inline and linked JavaScript for Supabase project refs, URLs, API keys, and createClient(...) calls.

python3 -m bad_vibes.cli discover https://target.example

With source snippets:

python3 -m bad_vibes.cli discover https://target.example --include-source

Auto-run live access probes for any discovered credentials:

python3 -m bad_vibes.cli discover https://target.example --run-probe

Analyze a local schema file

python3 -m bad_vibes.cli analyze schema.json

Probe live access (the main event)

Combines read and safe write probes into a single access matrix:

python3 -m bad_vibes.cli probe-access \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY"

Single table:

python3 -m bad_vibes.cli probe-access \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY" \
  --table users

With real insert testing:

python3 -m bad_vibes.cli probe-access \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY" \
  --test-post

Probe read access only

python3 -m bad_vibes.cli probe \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY"

Probe write permissions

Non-destructive PATCH/DELETE probes using impossible filters:

python3 -m bad_vibes.cli probe-write \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY"

Validate against a live project

python3 -m bad_vibes.cli validate \
  schema.json \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY"

With live probing:

python3 -m bad_vibes.cli validate \
  schema.json \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY" \
  --probe-live

Compare two local schema files:

python3 -m bad_vibes.cli validate \
  schema.json \
  --live-schema another-export.json

JSON output

All commands support --format json:

python3 -m bad_vibes.cli analyze schema.json --format json

Timeout control

Probe commands accept --probe-timeout (default 30s) to prevent hangs on unresponsive endpoints:

python3 -m bad_vibes.cli probe-access \
  --project-ref your-project-ref \
  --api-key "$SUPABASE_ANON_KEY" \
  --probe-timeout 10