https://shipreadyai.dev/learn/findings/o12-objects-readable

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Files in a listing bucket open without a session

One object address from each of these buckets answered a plain request with no session: {buckets}. Anything stored there can be read by anyone who can list it.

## Why AI-built apps get this

File storage is created the moment an app needs an upload, and the bucket is public because that is the setting that makes the first upload appear on the page. Nothing later goes back to close it, and every file added after that inherits the decision.

## Evidence line

the bucket listing answered the published browser key with 4 buckets, 2 of them public

## The fix

Make those buckets private and hand out short lived links for the files people are meant to see.

## Prompt

Make every bucket holding customer files private and serve those files through short lived signed links.