2026-11-13 · Daily security tips

Are user uploads sitting in a public Supabase bucket?

AI builders often tick Public on a Storage bucket so images just work. Then invoices, IDs or private photos go into the same bucket. Public means anyone with a file's URL can download it, no login needed. A storage.objects policy that lets anon select rows can also let anyone list the files.

Check: in Supabase open Storage and see which buckets say Public. Then, signed out, call supabase.storage.from('bucket').list() with your anon key. Getting file names back means strangers can too.

Fix: keep public buckets for files that are truly public, like logos. Make the rest private and serve files with createSignedUrl, which expires. Scope policies to each user's folder, for example (storage.foldername(name))[1] = auth.uid()::text.