LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Who may see what
  4. · 4 minutes · Pro

The bucket of ID photos

Users upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.

This answers: Are files in my storage bucket private? No coding needed. 3 quick decisions.

  • Who may see what
  • Keeping data safe

Checking your access…

Are files in my storage bucket private?

Only if the is private and its policies restrict access. A public bucket serves every file to anyone with the address, however secure your database is. Store private files in a private bucket, have the server create short-lived for the right user, and delete sensitive files once you no longer need them.

Trail of the bug
  1. Stranger
  2. File storage

Breaks at File storage: Public bucket serves every file

Why AI tools write this bug

Tutorials and generated code often make public because it makes uploaded images appear instantly without extra code.

How to fix it

  1. Check each 's public or private setting.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

Common questions

Is a long random file name enough to keep a file private?
No. Links leak through emails, logs and screenshots. Use private buckets and signed links.

Related scenarios

  • Invoice 105Free · 4 min
  • The agent that reset productionFree · 5 min
  • Approve this command?Free · 4 min

More on this trail

Who may see what: Sign-in, permissions, and the leaks AI-built apps ship most often.

Want someone to look?

We check AI-built apps for this and three other common leaks, in plain English.

Check my app
Sign in

Sign in to walk this one

3 decisions, about 4 minutes, and a prompt to check your own app for the same problem.

Sign in No password. We email you a link.

How to fix it

  1. Check each 's public or private setting.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock