Supabase
Security & compliance
No RLS policy on storage.objects for a bucket
Part of the Storage safety check · fix arrives as a pull request
What it is
A bucket has no RLS policy on storage.objects, so access is not scoped to the object owner.
Why it matters
Bucket privacy controls who can read without a key; policies control who can read with one. Without them, any authenticated user can list and fetch other users' objects through the Storage API.
How to fix it
Add policies on storage.objects filtered by bucket_id and by the owner — commonly comparing auth.uid() against the first path segment. Write separate policies for select, insert, update, and delete.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.