{"id":22233,"plugin_id":"plugins_6ab01c9056c481918eac972df8fb396d","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:17:11.896Z","digest":"23cda5ed83f262154b3b538e3a70f575054c7b545bfedea617b65db10751bf77","against":null,"payload":{"name":"supabase-auth-and-sessions","description":"Review Supabase Auth identity, JWT claims, sessions, recovery, OAuth, and account lifecycle security.","included_files":[],"skill_md_contents":"---\nname: supabase-auth-and-sessions\ndescription: Review Supabase Auth identity, JWT claims, sessions, recovery, OAuth, and account lifecycle security.\n---\n\n# Supabase Auth and Sessions\n\nCheck SSR client usage, `getUser` versus untrusted session assumptions, cookie flags, token expiry and refresh, logout, recovery, OAuth redirect allowlists, email verification, MFA, anonymous users, user deletion, stale JWT claims, and session revocation. Never use user-editable metadata for authorization. For strict revocation requirements, validate the session lifecycle on sensitive operations.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}