https://shipreadyai.dev/learn/findings/o12-bucket-public

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Some storage buckets are readable by anyone with the address

These buckets are marked public, so any file inside one can be read by anyone who knows or guesses its address: {buckets}.

## Why AI-built apps get this

File storage is created the moment an app needs an upload, and the bucket is public because that is the setting that makes the first upload appear on the page. Nothing later goes back to close it, and every file added after that inherits the decision.

## Evidence line

the bucket listing answered the published browser key with 4 buckets, 2 of them public

## The fix

Make each bucket private unless every file in it is meant for the open internet, and serve private files through short lived links instead.

## Prompt

Set every storage bucket that holds customer files to private and serve those files through short lived signed links.