Supabase
Security & compliance
getPublicUrl() used for user-specific storage object — enumerable by anyone
Part of the Storage safety check · fix arrives as a pull request
What it is
getPublicUrl() is used to build a link to an object that belongs to a specific user.
Why it matters
The URL it returns is permanent, unauthenticated, and derived from the object path — so it can often be guessed from a neighbouring one. It also keeps working after the user deletes their account.
How to fix it
Use createSignedUrl() with a TTL matched to the use, and keep the bucket private. Reserve getPublicUrl() for genuinely public assets such as marketing images.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.