VQV Signal
According to a post on X by @RomeWorkshop, in a public storage bucket anyone with the link can open users' invoices. The post suggests one row-level security policy on storage.objects so users can only sign links to files in their own auth.uid() folder. It also notes that a public URL still works after a user logs out.
According to a post on X by @RomeWorkshop, in a public storage bucket anyone with the link can open users' invoices. The post suggests one row-level security policy on storage.objects so users can only sign links to files in their own auth.uid() folder. It also notes that a public URL still works after a user logs out.
AI-assisted summary based on the listed source.
@RomeWorkshop warned that in a public storage bucket anyone with the link can open your users' invoices. His fix is one row-level security policy on storage.objects so users can only sign links to files in their own auth.uid() folder, noting that a public URL still works after a user logs out. Why it matters: App...
App builders who store user documents in file storage may be able to close this common data-leak path with a single policy, according to the post. Teams should check whether their buckets are public and whether signed links are limited to each user's own folder. Independent confirmation of how the policy behaves in practice would be worth watching for.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
VQV surfaced this signal because it is recent, relevant to AI Search, connected to Scobleizer News Pulse (X).
No login, cookies, social SDKs, or automatic posting.
