Supabase storage bucket public: how to protect your files

By Shinobi Tech, the team behind AppLeakWatch. Updated November 3, 2026.

Anyone with the link can open a file in a public Supabase bucket. That's fine for logos and product photos, but not for user uploads. Make those buckets private and serve the files through short-lived signed URLs.

Why this happens

Public buckets are the quickest way to get images showing, so generated code often uses one for everything, including private documents.

How to check

In Supabase, open Storage and see which buckets are marked public.
List what each public bucket holds. IDs, invoices and personal photos shouldn't be there.
Open a file's URL in a private window. If it loads, anyone with the link can see it.

How to fix it

Make any bucket holding private files private.

Add a policy so users can reach only their own folder:

create policy "Users read own files"
on storage.objects for select
using (
  bucket_id = 'uploads'
  and auth.uid()::text = (storage.foldername(name))[1]
);

Use signed URLs with a short expiry for showing private files.
Assume links already shared may have been copied, and review what was exposed.

Prompt for your AI tool

List every Supabase storage bucket this app uses and what it holds. Make buckets with user files private, add policies so users reach only their own files, and switch the app to short-lived signed URLs.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Are public buckets ever OK?

Yes, for files meant for everyone, such as logos and product images.

Does a long random file name protect me?

Not reliably. Links get shared and logged, so private files need real access rules.