Lovable·FixsecuritySupabaseintermediate

Supabase Storage Bucket Is Public by Mistake in a Lovable App

Quick Answer

The bucket was created as public or the storage policies allow broader reads than intended. In beginner builds this often happens because the upload flow worked before the privacy model was defined. Start with "Check bucket visibility first" before making broader code changes.

Quick Fix Summary

Most likely cause	The bucket was created as public or the storage policies allow broader reads than intended. In beginner builds this often happens because the upload flow worked before the privacy model was defined.
Fastest fix	Check bucket visibility first
Use this page if	Private uploads open to anyone with the URL

You're in the right place if...

!Private uploads open to anyone with the URL
!User files are readable without auth
!The bucket is marked public even though uploads should be private

Why this happens

The bucket was created as public or the storage policies allow broader reads than intended. In beginner builds this often happens because the upload flow worked before the privacy model was defined.

Fix

Check bucket visibility first

Open Supabase Storage and inspect the bucket settings. If it is public, every file URL can be shared and fetched without signed access.

Switch to private access and signed URLs

Keep the bucket private and generate short-lived signed URLs for files users are allowed to read.

Add owner-based storage policies

Match file access to the authenticated owner instead of broad authenticated access.

create policy "Users can read own objects"
on storage.objects for select
using (bucket_id = 'uploads' and auth.uid()::text = owner);

create policy "Users can upload own objects"
on storage.objects for insert
with check (bucket_id = 'uploads' and auth.uid()::text = owner);

Patch the generated upload flow

Tell Lovable to stop using public URLs for private documents.

Copy this prompt

This app stores user uploads in Supabase Storage. Assume uploads are private by default. Make the bucket private, add owner-based policies, and use signed URLs when rendering files to authorized users.

Prevent this next time

Decide whether a bucket is public or private before users upload anything. Retroactively cleaning up exposed files is slower and messier.