Supabase public bucket: can anyone open your users' files?
Ship ItChecked against the official source
Source checked 10 Oct 2026 · Published 21 Oct 2026 · Last reviewed 21 Oct 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Supabase's docs say a public bucket effectively bypasses access controls for retrieving and serving files: anyone who has a file's URL can open it. That's fine for things like profile pictures or blog post images, not for private files like ID photos or invoices. Buckets are private by default, every operation in a private bucket goes through your RLS policies, and you can share a private file with a signed URL that works for a limited time.
What to do
- Check which of your Storage buckets are public, and what files go in each one.
- Move private files, like users' ID photos or documents, to a private bucket.
- Share those files with signed URLs (createSignedUrl) that can be accessed for a limited time.
- Ask your AI tool: "List every Supabase Storage bucket in this app, say if it's public, and what files go in it. Move private files to a private bucket and use signed URLs."
Good to know
- In any bucket, uploads need an RLS policy first: by default, Storage "does not allow any uploads to buckets without RLS policies."
Source
Checked on 10 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.