User uploads in a public bucket

Steps

1. Check bucket visibility in Supabase Storage, Firebase or S3.
2. Move private files to private buckets.
3. Serve them through short-lived signed URLs.

Why it matters

This is a common failure pattern in apps built quickly with AI coding tools. The steps above check your own app only. Never test apps you don't own.