Open buckets: the folder the whole internet can read

Cloud storage buckets (Firebase Storage, Supabase Storage, S3-style folders) often default to public. If nobody changes the rules, anyone with the URL can list, read, or overwrite your users' files.

What can go wrong

When Firebase or Supabase storage rules say allow read, write: if true (or the Realtime Database equivalent ".read": true), the bucket is world-readable and often world-writable.

Builders enable "test mode" during development and forget to lock it down before launch. AI-generated configs frequently paste the permissive template because the app "needs to upload photos."

Verification selfies, government ID scans, chat attachments, and private messages in an open bucket are one guessed URL away from a headline.

It happened for real

In July 2025, the Tea App dating platform left Firebase Storage rules open. Forbes reported roughly 72,000 private images exposed, including about 13,000 verification ID photos, plus 1.1 million messages in an open Firestore collection (Forbes citing 404 Media, Jul 2025).

In May 2026, RedAccess scanned roughly 380,000 Lovable, Base44, Replit, and Netlify apps and found about 5,000 leaking sensitive data, with Axios-verified victims including medical and financial records (Axios, May 2026).

How to check yours

Seatbelt flags this automatically. Open Firestore rules (allow read, write: if true), open Firebase Realtime Database rules (".read": true), and equivalent wide-open storage configs in your repo are must-fix hard gates.

Honest hole: bucket-level "public" toggles set only in the Firebase or Supabase console may not appear in the repo export you hand us. Check the dashboard by hand.

Ask your agent: "Find every storage.rules, firestore.rules, and database.rules.json file. Flag any rule that allows read or write for all users. List file and line."

We don't catch this yet: Console-only bucket ACL changes with no rules file in the repo.

Fix direction

Replace open rules with owner-scoped checks (request.auth.uid == resource.data.userId or your stack's equivalent). Never ship test-mode rules to production.

Paste into your agent: "Audit Firebase and Supabase storage rules. Remove any if true read/write rules. Scope uploads and downloads to the signed-in user. Show me the before and after."

Related risks

withseatbelt-risk-open-buckets

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /risks/open-buckets
title        Open buckets: the folder the whole internet can read · Seatbelt risk reference
description  Storage defaults to public and nobody changes it. Verification selfies and private files become anyone's download.

# risk
slug      open-buckets
title     Open buckets: the folder the whole internet can read
summary   Storage defaults to public and nobody changes it. Verification selfies and private files become anyone's download.
surface   Databases and storage
coverage  covered (whether the Seatbelt scan gates on this risk)
verified  2026-07-20
related   /risks/rls-off-or-theater, /risks/idor-url-id-change
note      The full entry text is the human view of this page.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.