Public buckets versus listable buckets
Two different settings, and the second is almost never intended.
The distinction
Serving a file publicly and letting anyone read the bucket index are separate permissions. On S3 they are s3:GetObject and s3:ListBucket; on Google Cloud they are storage.objects.get and storage.objects.list.
Public read on specific objects is a normal choice for assets. A listable bucket means nobody has to guess file names — they read the index and take what they like.
Why it matters most for uploads
Object paths for user uploads are usually predictable once you know the bucket: avatars/<user-id>/photo.jpg. The bucket name is the part an outsider does not have, so a listing turns a guessing game into a download.
The right shape
Deny list to everyone. Keep public read only on the specific objects that need it. For anything belonging to a user, do not make it public at all — serve it through a signed URL with a short expiry.
We only ever test buckets your own app named, and we ask for zero objects, so we learn that the bucket is listable without retrieving an inventory of your files.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site