Glossary
Storage bucket
The place uploaded files live, and the setting that decides who can read them.
What it means
A storage bucket is the folder your backend keeps uploaded files in: avatars, receipts, exports, whatever your app lets people attach. Each bucket carries one setting that matters more than the rest, which is whether it is public.
A public bucket serves any file inside it to anyone who has the address, with no sign in. That is the right answer for a logo and the wrong answer for a scan of someone's passport. The setting gets chosen in the first minute of building the upload feature, when the only thing being tested is whether the image appears, and it is almost never revisited.
A check from outside can ask the backend for the list of buckets and read the public flag it publishes. That is names and flags, never the files. What a file contains, and whether it should have been uploaded at all, is a question only you can answer.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026