feat(sdk): check Supabase organization member MFA

docs/docs.json

@@ -465,6 +465,13 @@
                   "user-guide/providers/stackit/authentication"
                 ]
               },
+              {
+                "group": "Supabase",
+                "pages": [
+                  "user-guide/providers/supabase/getting-started-supabase",
+                  "user-guide/providers/supabase/authentication"
+                ]
+              },
               {
                 "group": "Vercel",
                 "pages": [

docs/introduction.mdx

@@ -72,6 +72,7 @@ Prowler supports a wide range of providers organized by category:
 | [M365](/user-guide/providers/microsoft365/getting-started-m365)                           | Official | Tenants                      | UI, API, CLI |
 | [MongoDB Atlas](/user-guide/providers/mongodbatlas/getting-started-mongodbatlas)           | Official | Organizations                | UI, API, CLI |
 | [Okta](/user-guide/providers/okta/getting-started-okta)                                   | Official | Organizations                | CLI          |
+| [Supabase](/user-guide/providers/supabase/getting-started-supabase)                       | PoC      | Organizations / Members      | CLI          |
 | [Vercel](/user-guide/providers/vercel/getting-started-vercel)                             | Official | Teams / Projects             | UI, API, CLI |
 
 ### Kubernetes

docs/user-guide/providers/supabase/authentication.mdx

@@ -0,0 +1,42 @@
+---
+title: "Supabase Authentication in Prowler"
+---
+
+Prowler for Supabase authenticates to the hosted Supabase Management API using a **Personal Access Token** (PAT). Prowler reads the token exclusively from `SUPABASE_ACCESS_TOKEN`; there is no credential CLI argument, and Prowler does not read Supabase CLI state files.
+
+## Personal Access Token Security
+
+Supabase PATs inherit the privileges of the user account that created them. Use a dedicated least-privilege or read-only organization account where available, set a suitable token expiry, store the token in a secret manager, and rotate it regularly.
+
+<Warning>
+A PAT is not independently scoped to read-only Management API access. Compromise of the token grants the same Management API privileges as its issuing user account.
+</Warning>
+
+## Required Access
+
+The issuing account must be able to call:
+
+- [`GET /v1/organizations`](https://supabase.com/docs/reference/api/v1-list-all-organizations)
+- [`GET /v1/organizations/{slug}/members`](https://supabase.com/docs/reference/api/v1-list-organization-members)
+
+An invalid token returns `401`, insufficient organization permissions return `403`, and rate limiting returns `429`. Prowler treats all three as scan errors rather than compliant results. Supabase applies a standard limit of approximately 120 Management API requests per minute for each user and scope; Prowler uses the response rate-limit reset headers before retrying.
+
+## Configure Authentication
+
+Create a PAT from [Supabase Account Tokens](https://supabase.com/dashboard/account/tokens), then export it:
+
+```bash
+export SUPABASE_ACCESS_TOKEN="your-personal-access-token"
+prowler supabase
+```
+
+For CI/CD, configure `SUPABASE_ACCESS_TOKEN` as a masked secret environment variable. Do not place it in command arguments, repository files, or job logs.
+
+## Out of Scope
+
+This proof of concept does not support:
+
+- OAuth 2.0 Authorization Code with Proof Key for Code Exchange (PKCE)
+- Direct PostgreSQL authentication
+- Self-hosted Supabase deployments
+- Supabase CLI credential or state files

docs/user-guide/providers/supabase/getting-started-supabase.mdx

@@ -0,0 +1,40 @@
+---
+title: "Getting Started With Supabase on Prowler"
+---
+
+Prowler for Supabase scans hosted Supabase Cloud organizations through the Management API. This proof of concept checks whether each organization member has multi-factor authentication (MFA) enabled.
+
+<Warning>
+This proof of concept supports Prowler SDK and Prowler CLI only. It does not support onboarding through Prowler Cloud, Prowler Private Cloud, or Prowler Local Server; self-hosted Supabase; direct PostgreSQL access; or OAuth.
+</Warning>
+
+## Prerequisites
+
+1. A hosted Supabase Cloud account with access to at least one organization.
+2. A Supabase Personal Access Token (PAT) for an account that can list organizations and organization members.
+3. A dedicated least-privilege or read-only organization account where your Supabase plan and organization roles allow one.
+
+See [Supabase Authentication in Prowler](./authentication) for PAT setup and security guidance.
+
+## Run a Scan
+
+Set the PAT through the environment and run Prowler:
+
+```bash
+export SUPABASE_ACCESS_TOKEN="your-personal-access-token"
+prowler supabase
+```
+
+To run only the organization member MFA check:
+
+```bash
+prowler supabase --check organizations_member_mfa_enabled
+```
+
+## Checks Shipped
+
+| Check ID | Severity | Description |
+|---|---|---|
+| `organizations_member_mfa_enabled` | High | Creates one finding per organization member and fails members whose Supabase account does not have MFA enabled. |
+
+The finding resource UID is the Management API `user_id`. Prowler does not include member email addresses in findings or normal logs.