Scan rule · RSC-SEC-076
A stranger's account can see your uploaded files
Uses a throwaway account to check whether non-public storage buckets can be listed.
Why this matters
In Supabase, access rules for files are a separate layer and are regularly forgotten. The typical picture: the tables are properly separated, the bucket with uploaded IDs, contracts or invoices is not.
The proof works like it does for tables: an account the scan created in the same minute has never uploaded anything. If it still sees a file listing, those files necessarily belong to others.
Only the listing is requested, and only its length is reported. File names deliberately do NOT appear in the evidence — `invoice-smith-2025.pdf` is itself personal information. Nothing is downloaded.
Public buckets are excluded: access there is intended, and the external scan already reports them.
Scan tier
How to fix it
Bind storage policies per bucket to the owner — they are a separate layer next to the table rules.