Loading report…
← nittim
← nittimshared scan
supabase/supabase ↗ · 233cbdc · Aug 21, 2026, 10:40 PM
No issues found
Free scan · deterministic evidence only
No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.
71 of 16949 files scanned (<1%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
Read 71 of 500 selected files — this repository's archive was too large to finish in one scan.
What this means
Two scanners read 71 of 16949 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Worth knowing, not blocking
doc sampleJSON Web Tokenapps/docs/.env.development:18
NEXT_PUBLIC_MISC_ANON_KEY="eyJhbG…0E2M" — non-production path
dev depnpm js-yaml3 in 1 version
3.14.2 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency
dev depnpm jsrsasign3 in 1 version
11.0.0 — GHSA-464q-cqxq-xhgr, GHSA-5jx8-q4cp-rhh6, GHSA-8g7p-jf3g-gxcp
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations — devDependency
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation — devDependency
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs — devDependency
dev depnpm simple-git3 in 1 version
3.24.0 — GHSA-hffm-xvc3-vprc, GHSA-jcxm-m3jx-f287, GHSA-r275-fr43-pm7q
simple-git is vulnerable to Remote Code Execution — devDependency
simple-git Affected by Command Execution via Option-Parsing Bypass — devDependency
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE — devDependency
dev depnpm smol-toml@1.3.1GHSA-v3rj-xjv7-4jmq
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines — devDependency
dev depnpm yaml@2.8.1GHSA-48c2-rrv3-qjmp
yaml is vulnerable to Stack Overflow via deeply nested YAML collections — devDependency
AI audit · supabase/supabase · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 71 of 16949 files (highest-priority subset) · supabase/supabase
Dependency manifests: 2 package roots found, 2 scanned.
README badge
[](https://nittim.com/library/supabase/supabase)