Make your Supabase storage buckets private if they hold user files

Supabase Storage keeps files in buckets, and each bucket is either public or private. In a public bucket, anyone who has a file's link can open it without logging in. That's fine for logos and product photos. It's a problem for things your users upload: ID photos, invoices, contracts or private pictures.

AI builders often make a bucket public because it's the quickest way to get images showing on screen.

The fix: open the Supabase dashboard, go to Storage and check each bucket. If one holds anything personal, edit it and turn off "Public bucket". Then ask your builder to show those files with signed URLs (links that expire) and to add storage policies so each user can only reach their own files. Test that your app still loads them.

Want an outside check of your live app? Run the free 15-second scan at leakyvibe.com.