A public Storage bucket serves private files

Symptom

A document or invoice URL loads in a private window, with no login.

Root cause

Supabase's storage guide says buckets are private by default. A public bucket bypasses access checks for retrieving and serving files: anyone with the asset URL can read it. Uploads, deletes, moves, and copies are still controlled. Private files need a private bucket and either the user's JWT or a short-lived signed URL. Lovable's security overview says the Quick scan's database review also covers file storage rules.

In this project's Supabase storage only:

1. Set buckets that hold private files to private.
2. Stop building public URLs for those objects. Use createSignedUrl with a short expiry, or download with the user's session.
3. Add storage.objects policies so a user can read only their own path prefix, typically the first folder equals auth.uid().
4. Leave a bucket public only for files you intend to publish, such as marketing images.

Do not change buckets in any other project.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Storage settings, note which buckets are public.
2. Copy a URL your app shows for a private file. Open it in a private window while signed out. A private file should not load.
3. Sign in as a second test user in your app and request the first user's file path. It should be denied.

Sources

• Supabase: Storage Buckets
• Lovable: Security overview