// SECURITY
Are the files your users upload sitting in a public bucket?
Updated 2026-08-11 · 4 min read
If your storage bucket is public, every file uploaded to it, ID photos, invoices, private images, can be listed or downloaded by anyone, often without even a link. Storage should be private by default, with signed URLs or per-user rules controlling who can read each file.
What it is
Supabase Storage and Firebase Storage hold user uploads. A "public" bucket serves any file to anyone who has (or guesses) its path. A private bucket only serves files through rules or short-lived signed URLs.
Why it matters to you
People upload sensitive things: government IDs, receipts, personal photos. A public bucket turns that into a folder anyone can browse, the kind of leak that ends up dumped online.
How to tell if your app has it
- Find a file URL your app loads (right-click an image, "copy image address").
- Open it in a private/incognito window while logged out.
- If it loads, the bucket is public. Try editing the path to guess other files.
How it happens in AI-built apps
Making the bucket public is the fastest way to get an uploaded image to display, so that is what AI builders do. Private buckets with signed URLs take an extra step the tool skips.
The fix
- Make buckets private by default.
- Serve files through signed URLs (Supabase createSignedUrl) or per-user Storage rules (Firebase).
- Never rely on an unguessable path as the only protection.
Key takeaways
- Public buckets expose every file, often without a link.
- Test by opening a file URL while logged out in incognito.
- Make storage private and serve files via signed URLs or per-user rules.
Frequently asked
What about profile pictures that should be public?
Genuinely public assets (like a logo) are fine in a public bucket. The rule is: anything tied to a specific user or private by nature belongs in a private bucket with access control.