Judel777

Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC

Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

Capgo - Rate Limit Bypass via User-Controlled device_id Parameter

Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key

Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2

Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter

Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane

Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint