Supabase Security & compliance

getPublicUrl() used for user-specific storage object — enumerable by anyone

Part of the Storage safety check · fix arrives as a pull request

What it is

getPublicUrl() is used to build a link to an object that belongs to a specific user.

Why it matters

The URL it returns is permanent, unauthenticated, and derived from the object path — so it can often be guessed from a neighbouring one. It also keeps working after the user deletes their account.

How to fix it

Use createSignedUrl() with a TTL matched to the use, and keep the bucket private. Reserve getPublicUrl() for genuinely public assets such as marketing images.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.