File storage open to everyone
Supabase or Firebase storage buckets where anyone can list or download uploaded files.
Where it shows up: Supabase Storage and Firebase Storage
Last updated
What it is
Apps store uploads such as avatars, invoices and documents in storage buckets. A bucket marked public, or with rules that allow anonymous reads, serves every file to anyone.
It's easy to make a bucket public to get an image showing, then start storing private files in the same bucket later.
How often we see it
We ran Shippable's static checks on about 1,460 public GitHub repos built with five AI tools (October 2026). Each figure is the share of that builder's repos where the check fired at least once. A dash means it wasn't among that builder's most common findings. Full method and breakdown: Which AI builder ships the safest apps?
What an attacker sees
Anyone who knows or guesses a file's path can download it. If listing is allowed too, they can see every file in the bucket.
How to fix it
Paste this into your AI tool:
Security fix: my storage bucket is public. Make it private and add storage policies so only authorized users can read their own files. Keep a separate public bucket only for assets that are meant to be public, like logos.
Or by hand:
- In Supabase → Storage, set each bucket to Private unless it only holds truly public assets, then add access policies.
- In Firebase, update Storage rules so reads require `request.auth != null` and match the file's owner.
- Re-scan to confirm.
Check your app
Shippable asks your storage for its bucket list as an anonymous visitor and flags buckets marked public. For Firebase Storage it checks whether files can be listed without logging in. It never downloads your files.
Scan your dev server before you push. No account needed:
Or scan your live app in the browser: