School · Module 2 · Lesson 4 of 4
Keep storage buckets private by default
A public bucket is a CDN for whatever users upload, including other users' files.
Make Supabase Storage buckets private unless the object is meant to be world-readable (for example marketing images).
Serve private files with short-lived signed URLs created on the server. Add storage policies so users can only read their own prefix.
Limit upload size and MIME type on the server. Do not trust the Content-Type the browser sends alone.