Auth and database

Keep storage buckets private unless they must be public

Make storage buckets private, add storage policies, serve files with signed URLs, and limit upload size and type on the server.

Why it matters

Files in a public bucket can be downloaded by anyone with the URL, and URLs leak through logs, emails and the browser. Unlimited uploads can also fill your storage bill.

How to fix it

1. Make buckets private unless the files are genuinely public (logos, marketing images).
2. Add storage policies so users can only read and write under their own folder.
3. Serve private files with short-lived signed URLs.
4. Set a maximum file size and allowed MIME types on the bucket or in your upload route, not only in the browser.

const { data } = await supabase.storage
  .from("invoices")
  .createSignedUrl(`${user.id}/inv-42.pdf`, 60); // valid for 60 seconds

How to verify

• Open a private file's plain object URL in a private window; it should fail.
• Try uploading a file over the size limit; it should be rejected by the server.

Related checks

• Enable Supabase RLS on every table
• Check permissions on the server
• Add bot protection to public forms

Tick it off in the full checklist