Public storage bucket

ExplainWhat it is

A public bucket serves its files to anyone who has the URL, with no sign-in. That is right for avatars and product photos. It is a leak when the bucket holds personal files: ID documents, CVs, invoices, signed contracts, medical letters.

It gets worse when a broad read policy on storage.objects also lets visitors list the bucket, because then nobody needs to guess the links.

ExploitExample of vulnerable code

Simplified from the patterns we see in AI-built apps. Synthetic: not taken from any real app.

insert into storage.buckets (id, name, public)
values ('documents', 'documents', true);

-- Often paired with a broad read policy that also allows listing
create policy "Anyone can view documents"
  on storage.objects for select
  using (bucket_id = 'documents');

CheckCheck it yourself

-- 1. Which buckets are public?
select id, name, public from storage.buckets where public;

-- 2. Who can read objects (and so list file names)?
select policyname, roles, cmd, qual
from pg_policies
where schemaname = 'storage' and tablename = 'objects';

FixThe fix PatchLabs writes

PatchLabs makes the bucket private and lets each user read only the files in their own folder. The app then shows files through short-lived signed links.

update storage.buckets set public = false where id = 'documents';
drop policy "Anyone can view documents" on storage.objects;
create policy "Owners read own documents"
  on storage.objects for select
  to authenticated
  using (
    bucket_id = 'documents'
    and (storage.foldername(name))[1] = (select auth.uid())::text
  );

The code change that ships with it: replace getPublicUrl(path) with createSignedUrl(path, 60) wherever the app shows these files, and upload to <user id>/filename. The report lists each place.

Every fix arrives as a migration file (plus any code change it needs, noted in the report) for your engineer to approve. Download it, or commit it on GitHub in one click from the report page. Automatic pull requests need our GitHub App, which is coming.

ProveThe proof it runs

[BEFORE]  anon list documents → 3 LEAK
[AFTER]   anon      → 0 objects     DENIED
          stranger  → 0 objects     DENIED
          owner     → 1, own folder OK

The listing test reads storage.objects as each identity. It is included as SQL for your engineer; the automatic proof today covers your tables. Whether a public URL still works is decided by the bucket's public flag, which the fix sets to false.

IntentWhen the pattern is intended

Public buckets are right for files meant for everyone: avatars, product images, logos, blog images. Keep them public, and keep personal files in a separate private bucket. If a public bucket only holds public assets, there is nothing to fix.

MapSupabase linter

0025 public_bucket_allows_listing

Flags public buckets whose object policies let clients list their files.

See alsoRelated findings

Guides

• How to secure a Lovable app’s Supabase database
• Supabase storage bucket policies: public, private and per-user folders

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.