https://shipreadyai.dev/learn/findings/o12-objects-listable

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Storage buckets list their objects without a sign in

An object list request carrying only the browser key came back from these buckets: {buckets}. The counts show how much is behind each name. ShipReady records names and counts and never keeps an object name or a file.

## Why AI-built apps get this

File storage is created the moment an app needs an upload, and the bucket is public because that is the setting that makes the first upload appear on the page. Nothing later goes back to close it, and every file added after that inherits the decision.

## Evidence line

the bucket listing answered the published browser key with 4 buckets, 2 of them public

## The fix

Require a signed in caller to list objects, and scope each bucket's rules to the person who owns the file.

## Prompt

Require an authenticated caller to list objects in every storage bucket, scoped to the owner of each file.