{
  "id": 4036366,
  "title": "Your Supabase Storage bucket is public - signed URLs will not save you",
  "url": "https://urgent.news/2026/08/28/your-supabase-storage-bucket-is-public-signed-urls-will-not-save-you",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-28T20:59:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/veristria/your-supabase-storage-bucket-is-public-signed-urls-will-not-save-you-519a"
  },
  "original_language": "en",
  "account": "Supabase Storage buckets can be configured to be public, allowing anyone to access objects directly using a stable URL, bypassing authentication. This can expose sensitive images generated privately using Sharp in Next.js API routes. To prevent this, turn off the public flag by updating the bucket settings, which will require authentication for access. Implementing row-level security policies to restrict access to only authenticated users and their respective folders ensures that only authorized individuals can view the images. Instead of providing raw object URLs, generate expiring signed URLs server-side using Supabase's `createSignedUrl` method, which adds a time-limited token for validation before serving the object. This approach safeguards against unauthorized access even if the signed URL is intercepted. By following these steps, the privacy of B2B images can be maintained while still allowing authenticated users to access the necessary resources securely.",
  "summary": "Problem You are generating private B2B images with Sharp in a Next.js API route and storing the derivatives in Supabase Storage. The bucket that holds those images is currently public , meaning anyone who can guess or discover the object URL can download the original or any derivative without authentication. This defeats the “private‑only” intent of your workflow and can expose sensitive business…",
  "key_points": [
    "Supabase Storage buckets can be public, exposing sensitive images.",
    "Turn off public flag to require authentication for access.",
    "Use signed URLs with expiration to safeguard against unauthorized access."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}