OpenAI Codex security directory

Supabase

Published by Supabase

High risk

Brings Supabase development guidance and project management into Codex. Manage and query databases through the connected integration. Get help with Postgres design, authentication, storage, functions and application integration.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Deploys edge functions and creates/pauses projects and branches: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
  • Branch deletion/reset and destructive SQL: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Creates migrations, .mcp.json and project code: Can read, create, or change files on the local filesystem or in a selected project.
  • Secrets, keys and database role grants: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • Arbitrary SQL against Supabase Postgres: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Files GitHub issues on supabase/agent-skills: Can send messages, comments, invitations, posts, or published content attributed to the connected user.
  • Creating projects/branches incurs billable cost: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 2 tools or capabilities.

  • supabase
  • supabase-postgres-best-practices

The interactive security report will load automatically.