By Partly fixable yourself. One or two storage policies, written in SQL
What you see. Uploading an avatar or document fails, or files upload but images show broken with a 403 or 400 from storage.
Why it happens
Supabase Storage is protected by the same Row Level Security as your tables, applied to the storage.objects table. Supabase states that Storage does not allow any uploads to buckets without RLS policies, and buckets are private by default. So a bucket the AI created with no policies rejects every upload, and a private bucket rejects every plain download link.
The details trip builders up. An upload needs an INSERT policy. Overwriting a file, which the code calls upsert, also needs SELECT and UPDATE. Reading from a private bucket needs a signed URL or the user's token, not a direct link. Buckets can also restrict file size and content types, which produces failures that look like permission errors. The common AI shortcut is to make the bucket public or to use the secret key, which turns a 403 into a leak of everyone's files.
Fix it yourself
- In the Supabase dashboard open Storage, select the bucket, then Policies. Check there is an
INSERTpolicy for theauthenticatedrole on this bucket. - If the code overwrites files, add
SELECTandUPDATEpolicies for the same users, since upsert needs all three. - Decide what the bucket holds. Public things such as avatars and product images can live in a public bucket. Invoices, documents and anything personal stay private and are shown through signed URLs.
- Scope uploads to the user. Ask the builder to store files in a folder named after the user's id and to restrict the policy to that folder.
- Check the bucket's file size and allowed content type limits. A 5 MB phone photo against a 1 MB limit fails before any policy runs.
- Test with two accounts. One user should not be able to open or list the other user's files.
When to get an engineer
Hire an engineer when files are mixed in one bucket with no ownership, when the app already used the secret key to make uploads work, or when private files were served from a public bucket. Tell them which buckets exist, what each holds, and who should see what. A one-off check costs $49–$800. Writing the policies and switching the app to signed URLs is a single fix at €99–$990, about two days of work.
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
File storage is private where it should be
Upload a private file, copy its URL, and open it in a private window. If it loads, the bucket is public.
Access rules are on for every table
In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say allow read, write: if true.
One user cannot open another user's records
Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Questions
Is making the bucket public an acceptable fix?
Only if every file in it should be visible to anyone with the link. Supabase says public buckets skip access control for reads, while uploads and deletes still follow your policies.
Are my uploaded files included in database backups?
No. Supabase's database backups do not include objects stored through the Storage API, so download or copy files separately.
Sources: Supabase docs: Storage Access Control; Supabase docs: Storage Buckets fundamentals; Supabase docs: Database Backups.