Storage bucket is public

What the finding looks like

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
-- Making bucket 'avatars' private means its objects are
-- only reachable through signed URLs or a policy on storage.objects.
UPDATE storage.buckets SET public = false WHERE id = 'avatars';

-- Then grant the access you actually intend, for example owner-scoped reads
-- where the first path segment is the user id:
CREATE POLICY avatars_read_own
  ON storage.objects
  FOR SELECT
  TO authenticated
  USING (
    bucket_id = 'avatars'
    AND (storage.foldername(name))[1] = ((SELECT auth.uid())::text)
  );

Related guides

• Detect Supabase schema drift after migrations
• What the Supabase Security Advisor does not do
• Continuous RLS monitoring for Supabase

What people search for