The upload URL that never stops working
Firebase's getDownloadURL mints a permanent public signed URL. It keeps working even when your Storage rules require auth, so the rules that look locked down in the dashboard are not protecting the link that was already minted.
What can go wrong
An upload handler calls getDownloadURL after the write and stores or shares the result. That URL embeds a long-lived token: anyone who has it can fetch the file forever, with no login, regardless of what the Storage rules say. ID photos and verification selfies are the highest-stakes case, because the whole point of collecting them was that strangers must not see them.
How to check yours
Seatbelt flags this automatically. Repo read flags getDownloadURL in upload and profile paths without a nearby server-signed-URL pattern; URL read flags the same shape in served code. Distinct from open Storage rules, which is its own entry.
Honest holes: a minted URL that is generated but never stored or shared is the same call with less exposure; the scan cannot tell how far the link traveled. Every hit in an upload flow deserves a read.
Ask your agent: "Show every getDownloadURL call. For each, could the returned URL reach a user, a database row, or a log? Replace those with short-expiry server-signed URLs."
Manual check: grep -rn getDownloadURL src/ (or your app folder). Every hit in an upload, profile, or verification flow deserves a read before you show anyone.
Fix direction
Prefer server-side signed URLs with a short expiry, or upload through a Cloud Function that returns a time-limited link.
Paste into your agent: "Replace getDownloadURL in upload and profile flows with server-generated signed URLs that expire, and audit where previously minted URLs were stored or shared."