Platform-Specific Agents

Our platform agents provide specialized security testing for Backend-as-a-Service (BaaS) platforms like Supabase, Firebase, and Convex. These agents understand platform-specific security models and test for common misconfigurations.

Why Platform-Specific Testing?

BaaS platforms have unique security considerations that general scanners miss:

The Problem

In 2024, security researchers found:

• 916 websites exposed 125 million records via Firebase misconfigurations
• Supabase RLS complexity leads to frequent authorization gaps
• Most issues stem from default configurations and misunderstood security models

Our platform agents catch these issues before attackers do.

Supabase Agent

Specialized testing for Supabase-powered applications.

What It Tests

Row Level Security Testing

The Supabase Agent analyzes your RLS policies:

Common Findings

Missing RLS Policy

❌ Critical: No RLS policy on users table

Table: public.users
Issue: RLS is enabled but no policies defined
Result: All authenticated users can read/write all rows

Impact: Complete data exposure to any authenticated user

Weak RLS Policy

⚠️ High: RLS policy allows horizontal access

Table: public.orders
Policy: SELECT where auth.uid() IS NOT NULL
Issue: Any authenticated user can view all orders

Expected: SELECT where auth.uid() = user_id

Storage Bucket Testing

Edge Function Security

Firebase Agent

Specialized testing for Firebase-powered applications.

What It Tests

Security Rules Testing

Firebase security rules are tested systematically:

Common Findings

Public Database Access

❌ Critical: Firestore allows public read/write

Rule: match /{document=**} { allow read, write: true; }
Issue: Anyone can read and modify any document

Impact: Complete data breach, data manipulation possible

Missing Authentication Check

⚠️ High: Storage allows unauthenticated downloads

Rule: allow read: if true;
Bucket: gs://project.appspot.com/user-uploads
Issue: Private user files accessible without authentication

Impact: Exposure of private user documents

What We Check

Convex Agent

Specialized testing for Convex-powered applications.

What It Tests

Common Findings

Exposed Internal Functions

❌ Critical: Internal function accessible publicly

Function: internalMutation:deleteAllUsers
Issue: Function marked as internal but accessible via public API
Result: Unauthorized users can invoke admin functions

Impact: Complete data manipulation possible

Missing Authorization

⚠️ High: Query returns data without authorization check

Function: query:getUserData
Issue: No auth check before returning sensitive data
Result: Any authenticated user can access any user's data

Expected: Verify ctx.auth.userId matches requested user

Vercel/Next.js Coverage

While not a dedicated agent, our web agents include Vercel-specific checks:

Common Findings

⚠️ Medium: Sensitive data in NEXT_PUBLIC_ variable

File: Client-side bundle
Variable: NEXT_PUBLIC_DATABASE_URL
Issue: Database connection string exposed to client

Impact: Database credentials visible to anyone

Platform Detection

Our agents automatically detect platform usage during each pentest—no configuration required:

Dynamic Adaptation

Platform detection happens at runtime, not configuration time:

• Automatic discovery - Add Supabase to your project next month, and we'll detect and test it automatically
• No reconfiguration needed - Switch from Firebase to Supabase? We adapt without any changes on your part
• Always current - We detect what's actually deployed, not what you configured months ago

This means your security testing stays accurate even as your technology stack evolves.

Security Best Practices

Supabase

1. Always enable RLS - On every table with user data
2. Test policies - Verify with different user contexts
3. Minimize anonymous access - Require auth when possible
4. Protect storage - Apply policies to buckets
5. Secure edge functions - Verify JWTs

Firebase

1. Never use open rules - Remove allow read, write: true
2. Validate ownership - Check request.auth.uid == resource.data.userId
3. Limit write access - Validate data being written
4. Secure storage - Match rules to application needs
5. Enable email verification - For user registration

Convex

1. Use internal functions - Mark admin functions as internalMutation/internalQuery
2. Validate authorization - Check ctx.auth in every function handling user data
3. Validate arguments - Use Convex validators for all function arguments
4. Limit public exposure - Only expose necessary functions as public
5. Audit function access - Review which functions are publicly callable

Next Steps

• Add your application - Platform detection is automatic
• Learn about Web Agents
• Learn about API Agents
• Understand the application model

Last updated: December 8, 2025