Is your Supabase Storage bucket public? How to check and lock it down

Public vs private Supabase Storage buckets, the storage.objects policies that control uploads and downloads, and signed URLs for private files.

Supabase Storage has two kinds of buckets. A public bucket serves every file to anyone who has (or guesses) its URL, without checking who is asking. A private bucket only serves files to requests your policies allow. AI builders often create buckets as public because it makes images "just work", which is fine for avatars and logos and bad for invoices, ID photos or user uploads.

How to check

1. In the Supabase dashboard open Storage and look at each bucket. Public buckets are labelled as public.
2. For each public bucket, ask: would I be okay if a stranger downloaded every file in here? If not, it should be private.
3. Open Storage → Policies and check the policies on storage.objects. A policy that allows insert for anon means strangers can upload to your project.

Fix

Make the bucket private, then allow each signed-in user to read and write only their own folder (files stored as <user id>/filename):

create policy "read own files" on storage.objects
  for select to authenticated
  using (bucket_id = 'uploads' and (storage.foldername(name))[1] = auth.uid()::text);

create policy "upload own files" on storage.objects
  for insert to authenticated
  with check (bucket_id = 'uploads' and (storage.foldername(name))[1] = auth.uid()::text);

To show a private file in your app, create a short-lived signed URL (createSignedUrl in supabase-js) instead of using a public URL.

Audit my Supabase Storage setup. List every bucket and whether it is public. Make any bucket that holds user uploads or private documents private. Store each user's files under a folder named with their auth user id, and add storage.objects RLS policies so authenticated users can only select, insert, update and delete files in their own folder. Replace public URLs for private files with createSignedUrl links that expire. Don't allow anon uploads.

Related: Enable Supabase RLS · Supabase anon key explained

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist