https://shipreadyai.dev/learn/findings/o12-buckets-listable

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# The storage bucket list answers without a sign in

A request with the browser key returned the names of {total} storage buckets: {buckets}. Names alone give a reader the shape of what you store.

## Why AI-built apps get this

File storage is created the moment an app needs an upload, and the bucket is public because that is the setting that makes the first upload appear on the page. Nothing later goes back to close it, and every file added after that inherits the decision.

## Evidence line

the bucket listing answered the published browser key with 4 buckets, 2 of them public

## The fix

Restrict the bucket listing to signed in callers, and keep only the buckets you meant to publish public.

## Prompt

Restrict the storage bucket listing so it does not answer an anonymous request, and review which buckets are marked public.