Supabase Storage bucket public or listable

Why it matters

Files in a listable bucket can be enumerated and downloaded by anyone.

How to fix it

Make the bucket private and serve files through signed URLs or owner-scoped storage policies.

How we test it

Passive — runs in the free check, looks only at what a browser can see.