3 people a09643c070 fix(scan): decode supabase jwt body as base64url (#348) ...

jwt payloads are unpadded base64url, but the supabase detector decoded
them with RawStdEncoding, which errors on any payload whose base64 lands
on the url-safe - or _ characters and silently skips the token. mirror
the jwt.go decoder: raw base64url with a padded fallback. extract the
decode into parseSupabaseJwtBody so it is unit-testable off the network.

Co-authored-by: vmfunc <vmfunc.lc@gmail.com>

2026-07-22 22:06:32 +00:00

..

frameworks

fix(scan): capture every chunk in next.js build manifest arrays (#345)

2026-07-22 21:54:46 +00:00

endpoints_test.go

feat(js): extract secrets and endpoints from scanned javascript

2026-06-09 18:11:38 -07:00

endpoints.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe2_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

scan.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

secrets_test.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

secrets.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

supabase_test.go

fix(scan): decode supabase jwt body as base64url (#348)

2026-07-22 22:06:32 +00:00

supabase.go

fix(scan): decode supabase jwt body as base64url (#348)

2026-07-22 22:06:32 +00:00