Files in a public Supabase Storage bucket can be downloaded by anyone who has the URL

Symptom

A file URL opens in a private browser window with no sign-inStorage policies you wrote for reads make no difference to downloadsPrivate user uploads, such as IDs or invoices, sit in a bucket marked public

Cause

Marking a bucket public bypasses access controls for retrieving and serving its files, so anyone who has a file's URL can fetch it. Uploads, deletes, moves and copies are still checked. Buckets are private by default; a bucket is public when it was created with public set to true or changed later.

Fix

Keep private user files in a private bucket and serve them with short-lived signed URLs created on the server, or with an authenticated request that carries the user's token. Use public buckets only for files anyone may see, such as avatars or marketing images.

ApplyCopy

// server only, with a client created from a secret key: make an existing bucket private await admin.storage.updateBucket('documents', { public: false }) // serve one file for an hour const { data, error } = await supabase.storage .from('documents') .createSignedUrl('private-document.pdf', 3600)

Affected

Supabase Storage buckets created or set with public true that hold files not meant for everyone

Sources

• https://supabase.com/docs/guides/storage/buckets/fundamentals
• https://supabase.com/docs/guides/storage/buckets/creating-buckets
• https://supabase.com/docs/guides/storage/serving/downloads

Last verified 2026-10-27 · Confirmed by 0 builders