Low

Storage bucket "avatars" is publicly readable

Affected:: storage.avatars
Category:: Storage
Confidence:: high
First detected:: 2026-08-12 11:04Z
Last verified:: 2026-08-16 09:41Z

Summary

Every object in "avatars" is retrievable by anyone holding the object path.

Why this matters

Public buckets are frequently used for user uploads. Once a path is known or guessable, the object is retrievable indefinitely with no session.

Evidence

Bucket: avatars
public: true
Object policy: Public read → true

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

Technical details

storage.buckets.public is true and object policy "Public read" uses an unconditional expression.

recommended remediation

Unlock the full security analysis

Buy full analysis

Make the bucket private and serve objects through signed URLs.

Current

UPDATE storage.buckets SET public = true WHERE id = 'avatars';

Proposed

UPDATE storage.buckets SET public = false WHERE id = 'avatars';

CREATE POLICY "Owner reads own objects"
ON storage.objects FOR SELECT TO authenticated
USING (bucket_id = 'avatars' AND owner = auth.uid());

Expected security effect

Anonymous object retrieval removed
Access bound to object owner

Compatibility risk

medium

Existing hard-coded public URLs stop resolving. Switch clients to createSignedUrl.

DBX never applies SQL to your database.