Public versus private content
- Public bucket suits: logos, marketing images, public product photos.
- Private bucket suits: identity documents, invoices, medical or legal files, user-generated files that others should not see.
- Listing enabled on a bucket lets anyone enumerate every file name.
Check your own buckets
- In your provider dashboard, list each bucket and its visibility setting.
- Try opening a file URL in a private window while logged out.
- Confirm listing is disabled and that object names are not guessable sequences.
Serve private files with signed URLs
const { data } = await supabase.storage
.from('documents')
.createSignedUrl(path, 60);
// data.signedUrl expires after 60 secondsAdd storage policies
Where the provider supports policies, restrict reads and writes to the file's owner, and cap file size and type on upload.
Frequently asked questions
Are long random file names enough?
They slow guessing, but a leaked URL still works forever. Signed URLs expire.
Should uploads be validated?
Yes. Check size and content type on the server, and store files outside any folder that executes code.