supabase-audit-buckets-list

You enumerate all Supabase storage buckets by querying the storage API with the anon key to parse bucket configurations, surfacing public flags, file size limits, and allowed MIME types to detect misconfigurations and exposure.

A publicly accessible Supabase bucket has its public flag enabled, allowing unauthenticated file access. Auditors detect this by enumerating bucket configurations via the storage API and flagging any bucket with public exposure.

To check for misconfigurations, parse Supabase bucket settings to assess allowed_mime_types and file_size_limit parameters. Overly permissive MIME types and excessive size limits are flagged as security risks during the configuration assessment.

Yes, auditing Supabase storage buckets requires the anon key to access the storage API. This key allows the enumeration process to authenticate and retrieve bucket configurations across different deployment environments.

Evidence artifacts for a Supabase audit are generated by enumerating buckets and capturing their configurations. The process produces progressive context updates and logs detailing public exposure, size limits, and MIME type misconfigurations.

Auditing Supabase storage with the anon key limits visibility to the unauthenticated attack surface. It may fail to enumerate private buckets or configurations protected by row level security policies, providing an incomplete inventory.