# Ensure storage buckets are private unless explicitly required to be public

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103909539503-ensure-storage-buckets-are-private-unless-explicitly-required-to-be-public
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Supabase Storage buckets are private unless they are intended to serve public content, such as website images. Files in private buckets can only be accessed by users allowed by Storage RLS policies or through signed URLs, instead of by anyone who has the file URL.

**Rationale**

Files in a public bucket can be downloaded by anyone who knows or guesses the URL, without any login or permission check. If private files such as user documents, invoices, or ID images are stored in a public bucket, they can be exposed to the internet. Keeping buckets private by default makes sure access is controlled by policies.

**Impact**

-   Files require permission or a signed URL to download
    
-   Prevents exposure of private files
    
-   Apps that use public URLs for these files must switch to signed URLs
    

**Default Value**

By default, new buckets are private. A bucket becomes public only if the Public bucket option is turned on.

**Pre-Requisites**

-   Project Owner, Admin, or Developer role
    
-   A list of buckets that must be public
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Storage in the sidebar.
    
4.  Check each bucket and note whether it is marked Public.
    
5.  If a bucket is public without a documented need, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Storage in the sidebar.
    
4.  Open the bucket's menu (three dots) and select Edit bucket.
    
5.  Turn off Public bucket and save.
    
6.  Add Storage RLS policies or use signed URLs for users who need access.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Storage in the sidebar.
    
4.  Open the bucket's menu and select Edit bucket.
    
5.  Turn on Public bucket and save.
    

**Reference**

-   [https://supabase.com/docs/guides/storage/security/access-control](https://supabase.com/docs/guides/storage/security/access-control)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.