Checks · DB-004

DB-004 · Public storage bucket with user uploads

Why it matters

A public bucket that stores user files lets anyone list or download those files.

How we detect it

Storage settings show a public bucket and the app uploads into it.

How we fix it

Make the bucket private and serve files with short-lived signed URLs.

Can it be fixed automatically? With review

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret