Supabase
Security & compliance
Cost
Storage upload has no MIME type or file-size limit
Part of the Storage safety check · fix arrives as a pull request
What it is
An upload path sets no allowed MIME types and no file size limit.
Why it matters
Users decide what and how much to store. That is a cost problem immediately and a security one shortly after — an HTML or SVG file served from your domain can carry script, and a public bucket becomes a place to host anything.
How to fix it
Set allowedMimeTypes and fileSizeLimit on the bucket so the limits are enforced server-side, and validate again in the upload handler. Do not rely on the client-side file input, which is trivially bypassed.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.