appwrite-security

Appwrite Security Auditor

Audit any Appwrite project for over-permissive collection/document permissions. Get a shareable HTML report with a fix snippet on every finding. Active probe fetches data anonymously to PROVE leaks live — not just infer them.

▶ Run it without installing anything → apify.com/renzomacar/appwrite-security-auditor (paste endpoint + project ID + API key, get HTML report)

⚡ Want me to run it for you and send back a written report? $99, 24h delivery → https://perufitlife.github.io/supabase-security-skill/ (one landing covers all five — Supabase, PocketBase, Appwrite, Hasura, Firebase)

Why this exists

Appwrite has a powerful but easy-to-misuse permission model: collections can grant operations (read, list, create, update, delete) to roles like any, users, team:<id>, or user:<id>. Three patterns I see over and over:

• any role on read or list — the collection is fully public. Anyone can dump every document without auth.
• users role too broadly — any signed-up user (including a self-registered anonymous one) reads or writes the entire collection.
• Document Security disabled — collection-level perms apply to ALL documents. A single broad rule exposes everything.

This auditor surfaces all of them across every database/collection in your project in one command.

Install + run

APPWRITE_ENDPOINT=https://cloud.appwrite.io/v1 \
APPWRITE_PROJECT_ID=your-project-id \
APPWRITE_API_KEY=your-server-key \
npx appwrite-security --html report.html

Or:

npx appwrite-security \
  --endpoint https://cloud.appwrite.io/v1 \
  --project xxx \
  --key xxx \
  --html report.html

What it checks

#	Check	Severity
1	Permission grants any role (anyone can perform op)	CRITICAL
2	Permission grants users role (every signed-up user passes)	HIGH
3	Document Security OFF on permission-protected collection	HIGH
4	Team-based permission lacks role specificity	MEDIUM
5	OAuth2 provider misconfig	MEDIUM
6	Email auth without verification	MEDIUM

Active probe

Default: ON. After detecting a read("any") or list("any") permission, the auditor sends an anonymous GET to /v1/databases/{db}/collections/{col}/documents?queries[]=limit(1). If documents come back, the finding is confirmed: true with row count, columns visible, and bytes leaked.

--no-probe disables the live fetch (passive metadata-only mode).

How to get an API key

• Open your Appwrite console → Project Settings → API Keys → "Create API Key"
• Required scopes: databases.read, collections.read, projects.read
• Copy the key immediately (Appwrite shows it only once)

The key is used only for this run's metadata reads. Never persisted.

License + source

MIT. Open source: https://github.com/Perufitlife/appwrite-security-skill

For Supabase, see https://github.com/Perufitlife/supabase-security-skill For PocketBase, see https://github.com/Perufitlife/pocketbase-security-skill