Nhost / Hasura Security Auditor

June 21, 2026 · View on GitHub

Audit any Hasura instance (or Nhost project) for permissive role permissions, missing row-level scoping, and public GraphQL leaks. Active probe confirms each leak by sending an anonymous GraphQL query and showing what comes back.

▶ Run it without installing anything → apify.com/renzomacar/nhost-security-auditor (paste Hasura endpoint + admin secret, get HTML report)

⚡ Want me to run it for you and send back a written report? $99, 24h delivery → https://perufitlife.github.io/supabase-security-skill/ (one landing covers all five — Supabase, PocketBase, Appwrite, Hasura, Firebase)

🔁 Want this running on a cron? RLS Monitor does weekly diff-based scans + email alerts when new findings appear — $29/mo, your keys never leave your CI.

📦 Need all 5 BaaS stacks at once? The BaaS Security Pack bundles every scanner + sample reports + fix-SQL libraries — one $99 download.

🪞 Sister tool: aitells detects + rewrites AI fingerprints in your text (em-dashes, "delve", parallel bullets). Free detector + $19 lifetime rewriter at /rewrite.

npm license node

Sister tools for other BaaS platforms (same --discover flag, all MIT): supabase-security · pocketbase-security · appwrite-security · firebase-security

Why this exists

Hasura's permission model is powerful but easy to leave too open. The patterns I see most often:

  • anonymous role with open SELECT permission — any unauthenticated request can query the table. Often a leftover from local dev.
  • user role with empty filter {} — any signed-up user can read/update/delete every row, ignoring ownership. Should usually be { user_id: { _eq: "X-Hasura-User-Id" } }.
  • SELECT permission with all columns — exposes sensitive columns (password_hash, internal_notes) the role doesn't actually need.
  • Public schema introspection — anyone can map your entire data model + permission structure without auth.

Install + run

HASURA_ENDPOINT=https://my.hasura.app \
HASURA_ADMIN_SECRET=$ADMIN_SECRET \
npx nhost-security --html report.html

For Nhost projects the endpoint is https://<subdomain>.hasura.<region>.nhost.run.

What it checks

#CheckSeverity
1anonymous role has open SELECT permissionCRITICAL
2anonymous role has INSERT/UPDATE/DELETE permissionCRITICAL
3user role has SELECT/UPDATE/DELETE without row-level filterHIGH
4Permission exposes all columns (no allowlist)MEDIUM
5GraphQL introspection enabled for anonymousMEDIUM

Active probe

For every suspect anonymous SELECT permission, the auditor sends an anonymous GraphQL query ({ <table>(limit: 1) { __typename } }) and reports confirmed: true if rows come back. For introspection, sends { __schema { queryType { name } } } and reports if anonymous can read the schema.

--no-probe disables the live fetch.

License + source

MIT. Open source: https://github.com/Perufitlife/nhost-security-skill

For Supabase, see https://github.com/Perufitlife/supabase-security-skill For PocketBase, see https://github.com/Perufitlife/pocketbase-security-skill For Appwrite, see https://github.com/Perufitlife/appwrite-security-skill

Want it done for you?

Two productized services:

Integration pattern reference

See rotatepilot-skyx-sandbox for a live demo of how a partner consumes one of our public REST APIs in a single static page — built 12-may-2026 in response to an aviation-platform partnership inbound. Same JSON-contract / CORS / edge-served approach we use for nhost-security integrations.

Sister AI text tools

If your team writes outreach, PR descriptions, or social posts with AI, the aitells ecosystem catches the fingerprints before they ship:

📚 Part of Awesome Backend Security Auditors — the full collection of keyless active-probe auditors.