Skip to content
Get a quote

Supabase StorageMy Supabase storage bucket is public. Are the files exposed?

Your app stores files in Supabase Storage, and a bucket is marked Public. That’s right for avatars and blog images, and wrong for invoices, IDs or anything private. Here’s what public means in Supabase’s own words, how to check, and how to fix it, or hand it over at a fixed price.

Short answer

A public bucket skips access control for reading files: anyone with a file’s URL can open it. Uploads, deletes and moves are still checked by your policies. Keep public buckets for files meant to be public, move private files to a private bucket with row-level security policies, and serve them through signed URLs or signed-in downloads.

What public means, and the fix

  1. 01

    Private files in a public bucket

    “This means that anyone who possesses the asset URL can readily access the file.” Supabase, Storage Buckets

    Anyone who has or guesses a file’s URL can open it, signed in or not. If the bucket holds documents, receipts, exports or anything users expect to be private, make it private, then check every file in it was meant to be shared.

  2. 02

    Private buckets need policies to work

    “When a bucket is set to Private all operations are subject to access control via RLS policies.” Supabase, Storage Buckets

    Buckets are private by default, and then every operation, downloads included, goes through row-level security policies on Storage. Write policies that let each user read only their own files, for example by storing files in a folder named after the user’s id.

  3. 03

    Links that stop working after the switch

    “Create a signed URL with the createSignedUrl method that can be accessed for a limited time.” Supabase, Storage Buckets

    Public file URLs won’t open once the bucket is private. Use a signed URL that expires, or download with the signed-in user’s session, and update anywhere the app stored the old public URL. Old public links may already be shared or saved elsewhere, so for anything sensitive that was exposed, upload it again under a new name.

  4. 04

    Uploads are still checked

    “Access control is still enforced for other types of operations including uploading, deleting, moving, and copying.” Supabase, Storage Buckets

    Public doesn’t mean anyone can upload or delete. Those still go through your policies, so check them too: a policy that lets any signed-in user write anywhere in the bucket lets them overwrite other people’s files.

Checked against the vendor’s docs on : Supabase docs: Storage Buckets (access model); Supabase docs: Storage Access Control.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Free AI app check · RLS is on: is the data safe now? · Is Lovable safe for a real app?

Questions

More on this error

Which files are fine in a public bucket?

Files you’d be happy to post on your website: profile pictures, product photos, blog images. Supabase names user profile pictures, user public media and blog post content as examples.

Can people list every file in my bucket?

Listing is controlled by your Storage policies, not by the public setting. Supabase warns that a broad read policy can let users list a bucket’s contents, and offers helper functions to treat listing separately from reading one known file. Check your read policies before assuming nobody can browse the bucket.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes