Supabase Storage bucket is marked public
ShipReady found one or more Supabase Storage buckets whose published bucket metadata has public read enabled.
Why it matters
Public buckets are useful for intentionally public assets, but they need deliberate object placement and access-design decisions.
How ShipReady detects it
What it inspects
After discovering a Supabase project and public anon key from client content, ShipReady requests the project's Storage bucket listing endpoint and reads bucket metadata.
What triggers a finding
The rule triggers when a successful bucket-list response includes a bucket with its public flag set to true.
What the evidence shows
The observed Supabase bucket metadata marks the reported bucket as public.
Limits of this check
ShipReady does not list objects, request an object, inspect bucket policies beyond the returned public flag, or determine which files exist. A public-bucket flag does not prove that every object is downloadable or that sensitive data is present.
How to fix it
Classify each bucket by intended audience
Keep only deliberately public assets in buckets intended for public delivery, and move private uploads to a bucket with an appropriate access model.
Review object and application access paths
Check Storage policies, signed URL use, upload paths, and object naming for the data your application actually stores.
How to verify the change
Verify the deployed bucket configuration
Use Supabase project settings and a controlled anonymous request to confirm each bucket has the intended public setting.
Expected: Only buckets meant for public delivery are marked public.