What a SableOffensive Report Looks Like

Description

The user profile API endpoint allows any authenticated user to access other users' profile data by modifying the user ID parameter. No server-side authorization check validates that the requesting user owns the requested resource.

Impact

An attacker can enumerate and access all user profiles including email addresses, billing information, and connected accounts. With approximately 2,400 users in the database, this exposes the complete user dataset.

Steps to Reproduce

1. 1.Authenticate as User A (test account)
2. 2.Send GET /api/users/{USER_A_ID} -- returns own profile (expected)
3. 3.Change ID to User B: GET /api/users/{USER_B_ID}
4. 4.Full profile data for User B is returned (unauthorized)
5. 5.Increment IDs to enumerate all users

Remediation

Add server-side authorization middleware that validates the requesting user's session matches the requested resource. Example for Next.js API route:

// Before (vulnerable)
export async function GET(req, { params }) {
  const user = await db.users.findById(params.id);
  return Response.json(user);
}

// After (fixed)
export async function GET(req, { params }) {
  const session = await getSession(req);
  if (session.userId !== params.id) {
    return new Response('Forbidden', { status: 403 });
  }
  const user = await db.users.findById(params.id);
  return Response.json(user);
}

Description

The Supabase service_role key is hardcoded in the client-side JavaScript bundle. This key bypasses all Row Level Security (RLS) policies and provides full database access.

Impact

An attacker with this key can read, modify, and delete any data in the Supabase database, bypassing all security policies. This is equivalent to direct database admin access.

Steps to Reproduce

1. 1.View page source or open DevTools > Sources
2. 2.Search for "supabase" in JavaScript bundles
3. 3.Find service_role key: eyJhbGci...[REDACTED]
4. 4.Use key with Supabase client to bypass RLS
5. 5.Full CRUD access to all tables confirmed

Remediation

Move the service_role key to server-side only. Use the anon key for client-side operations and ensure RLS policies are properly configured.

// .env.local (never expose to client)
SUPABASE_SERVICE_ROLE_KEY=eyJhbGci...

// next.config.js - ensure server-only
// DO NOT prefix with NEXT_PUBLIC_

// Server-side usage only:
import { createClient } from '@supabase/supabase-js'
const supabaseAdmin = createClient(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY! // server only
)