Lab results
Public bucket allows listing
0025_public_bucket_allows_listingWARN
Files in a public bucket can be opened by anyone who has their link; that is what public means. A broad select policy on storage.objects also lets anyone list every file in the bucket, so they no longer need the links: they can find and download everything.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select policyname, roles, qual
from pg_policies
where schemaname = 'storage'
and tablename = 'objects'
and cmd in ('SELECT', 'ALL');
- Line 3: Look for policies whose condition is only bucket_id = …: they make the whole bucket listable for the roles shown.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
To make uploads show up in the app, AI tools often add a select policy for the whole bucket.
The real fix
For a public bucket, drop the broad select policy; links keep working. If the files belong to individual users (invoices, ID photos, contracts), make the bucket private and hand out signed links with an expiry.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Uploaded files are rarely meant to be public in the first place. Look at what is actually in the bucket before deciding it can stay public.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
List every Supabase storage bucket my app uses, whether it is public, and every policy on storage.objects. For each bucket, tell me in plain English who can list and download its files. If users upload private files there, make the bucket private and change the app to use signed URLs. Remove select policies that make a public bucket listable. Do not delete any files.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.