Happy Halloween! Ember skipped the candy and went sniffing through Supabase Storage instead. The spookiest thing she found was user uploads anyone could open.

Here's why: when a Supabase Storage bucket is set to Public, anyone with a file's URL can download it. That's fine for logos. It's scary for invoices, IDs or private photos.

The two-minute check

  1. Open Supabase, then Storage, and look at each bucket's Public label.
  2. Holding private files? Make that bucket private, add policies on storage.objects, and use signed URLs that expire.
  3. Then scan your own app on SniffPup for other open doors.

No tricks, just treats.

Want one 2-minute check like this every morning? Sign up at sniffpup.com.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.

Originally published at sniffpup.com.