Public storage buckets and file access

Bucket names are the hard part of finding your users’ uploads.

Why the bucket list matters

Storage object paths are usually predictable once you know the bucket — avatars/<user-id>/photo.jpg. The bucket name is the part an outsider does not have, so a listable bucket list is the first step, not the whole problem.

The fix

Set every bucket that does not serve genuinely public assets to Private in the Supabase dashboard, then write policies on storage.objects so users reach only their own files:

Copy this

CREATE POLICY "own_files_only"
  ON storage.objects FOR SELECT
  TO authenticated
  USING (auth.uid()::text = (storage.foldername(name))[1]);

Serve private files through signed URLs with a short expiry rather than making the bucket public.

Not sure whether this applies to you?

Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.

Check a site