How to do a security audit of a Emergent (emergent.sh) app?

Why a Emergent (emergent.sh)-specific audit (not a generic web audit)

A generic OWASP audit will tell you your Emergent (emergent.sh) app "needs CSP headers." A Emergent (emergent.sh)-aware audit tells you that your specific Emergent (emergent.sh) app has an RPC function callable without auth or a service key in a client bundle — the issues that actually appear when Emergent (emergent.sh) apps get compromised. The difference in output value is why the audit should be scoped to Emergent (emergent.sh)'s real failure modes.

Step 1 — Fingerprint the deployment

Confirm the Emergent (emergent.sh) stack components: database (supabase, firebase, postgres), hosting, auth provider, third-party integrations. For Emergent (emergent.sh) apps this is often visible in the Supabase endpoint URL in network requests. Document every component — each is an independent audit target.

Step 2 — Automated scan with Emergent (emergent.sh)-aware rules

Run VAS against the deployed URL. The scan probes the specific issue classes found in Emergent (emergent.sh) apps: secrets scan, database security, auth testing, headers & config. This is the 80/20 — most critical and high findings surface here. Fix anything critical before continuing to manual steps.

Step 3 — Manual Row Level Security (RLS) policies review

Open the Supabase dashboard → Authentication → Policies. For each table: is RLS enabled? Do policies check `(select auth.uid()) = user_id` or equivalent? Are there policies scoped to the anon role that shouldn't exist? The automated scan catches missing RLS; this step catches overly permissive RLS — a subtler but equally dangerous failure mode.

Step 4 — Authentication & authorization probing

Test every endpoint with no session (expect 401), with a valid session for a different user (expect 403 on user-owned resources), and with session tokens that have been tampered with (expect 401 if signatures are enforced). For Emergent (emergent.sh) specifically, watch for insecure default auth configuration — generated auth flows may skip email verification, rate limiting, and password complexity requirements.

Step 5 — Re-scan to verify

Fix findings in severity order (critical → high → medium → low), re-scan after each batch of fixes. "I applied the fix" is not evidence — the fix might not have been deployed, might have been partial, or might have been reverted. Only the scan output proves the gap is closed. Log each finding + fix + verification scan for compliance records.

Emergent (emergent.sh)-specific checks often missed

• Exposed Supabase Credentials with Missing RLS
• Client-Side API Key Leakage
• Unprotected API Endpoints
• Insecure Default Auth Configuration