Description

Ensure Supabase Storage buckets are private unless they are intended to serve public content, such as website images. Files in private buckets can only be accessed by users allowed by Storage RLS policies or through signed URLs, instead of by anyone who has the file URL.

Rationale

Files in a public bucket can be downloaded by anyone who knows or guesses the URL, without any login or permission check. If private files such as user documents, invoices, or ID images are stored in a public bucket, they can be exposed to the internet. Keeping buckets private by default makes sure access is controlled by policies.

Impact

  • Files require permission or a signed URL to download

  • Prevents exposure of private files

  • Apps that use public URLs for these files must switch to signed URLs

Default Value

By default, new buckets are private. A bucket becomes public only if the Public bucket option is turned on.

Pre-Requisites

  • Project Owner, Admin, or Developer role

  • A list of buckets that must be public

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Storage in the sidebar.

  4. Check each bucket and note whether it is marked Public.

  5. If a bucket is public without a documented need, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Storage in the sidebar.

  4. Open the bucket's menu (three dots) and select Edit bucket.

  5. Turn off Public bucket and save.

  6. Add Storage RLS policies or use signed URLs for users who need access.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Storage in the sidebar.

  4. Open the bucket's menu and select Edit bucket.

  5. Turn on Public bucket and save.

Reference