Supabase
Security & compliance
Storage bucket is public — objects readable without auth
Part of the Storage safety check · fix arrives as a pull request
What it is
A Storage bucket is created with public: true while holding user-specific or otherwise private content.
Why it matters
Every object in it is readable by anyone with the URL — no authentication, no authorization. Object paths are usually derived from ids or filenames and are guessable, so "needs the URL" is weaker than it sounds.
How to fix it
Set the bucket to public: false and serve objects through createSignedUrl() with a short TTL. Add an RLS policy on storage.objects so only the owner can obtain a signed URL in the first place.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.