What is a public storage bucket?
A public storage bucket is a folder of uploaded files, like profile photos, invoices or documents, that anyone can open if they have the link. Links to files in a public bucket are easy to guess or find, so private files kept there are effectively public.
ON THIS PAGE
What it means
Services like Supabase Storage and Firebase Storage keep uploaded files in 'buckets'. A bucket is either public, where every file has a permanent open link, or private, where files can only be opened by people you allow.
Public is fine for things you want everyone to see, like a logo or a product photo. It is not fine for anything personal.
Why it matters for vibe-coded apps
Making a bucket public is the quickest way to get image uploads working, so AI tools do it, and it then gets used for files it should never hold.
- Invoices, ID scans and private documents can be opened by anyone with, or guessing, the link.
- Search engines and scrapers can discover and copy the files.
- Once a file link has been shared, you cannot take back who has seen it.
Example
Customers upload invoices and later download them.
// Bucket is public, so this link never expires
const { data } = supabase.storage.from("invoices").getPublicUrl(path);// Bucket is private. The link works for 60 seconds
const { data } = await supabase.storage.from("invoices").createSignedUrl(path, 60);Pair this with storage policies so each user can only ask for their own files.
How to check if your app has this problem
- 1Open your Supabase dashboard, go to Storage and look for buckets marked Public.
- 2For each public bucket, open a file and ask: would I be happy if a stranger saw this?
- 3In Firebase, check the Storage rules for allow read: if true.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Make any bucket that holds personal or private files private.
- 2Serve those files through signed URLs that expire quickly.
- 3Add storage policies so users can only reach files in their own folder.
- 4Move public assets, like logos, into a separate public bucket.
Find every Supabase storage bucket my app uses. For buckets that hold private user files, make them private, replace getPublicUrl with createSignedUrl using a short expiry, and add storage policies so a user can only read and upload files in a folder named with their own user ID. Keep a separate public bucket only for assets that are meant to be public. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for public storage bucket issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Row level securityA database setting that decides which rows each user can see or change.
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- Firebase security rulesThe rules that decide who can read and write data in Firebase.
- Database backupA saved copy of your data you can restore if something goes wrong.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.