Supabase
Security & compliance
Cost
Storage safety
Buckets and object URLs that are more public than intended.
Overview
lumioguard reads your Supabase Storage configuration and the upload and download paths in your code, and reports where private content is reachable without authentication or where an upload accepts anything a client sends.
What it looks for
- Public buckets holding user or tenant content
- No RLS policy on storage.objects for a bucket
- Uploads with no MIME type or file-size limit
- getPublicUrl used for content that should be per-user
- Signed URL TTLs long enough to function as permanent public links
Why it matters
A public bucket needs no credential and no exploit — just the object path, which is usually guessable. getPublicUrl on user content produces a permanent, enumerable link that survives the user deleting their account.
Rules in this check
| What it reports | Fix path |
|---|---|
| Storage bucket is public — objects readable without auth | Pull request |
| No RLS policy on storage.objects for a bucket | Pull request |
| Storage upload has no MIME type or file-size limit | Pull request |
| getPublicUrl() used for user-specific storage object — enumerable by anyone | Pull request |
| Signed URL TTL long enough to act as a public URL | Guide |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.