Public Storage Exposure
NullFault checks public storage buckets and objects referenced by the app and reports when files or listings look unintentionally reachable.
What NullFault Checks
- Whether browser-visible storage references point to publicly reachable buckets or objects.
- Whether listing behavior appears enabled or sensitive-looking object names are visible.
- Whether any reachable storage content appears to contain private material.
Why It Matters
- Public storage is fine for images and downloads, but private uploads and internal artifacts should not be readable by everyone.
- Bucket listing can turn a single URL leak into broad discovery of stored files.
- Storage exposures often come from policy defaults, migration shortcuts, or demo data left behind.
Common Causes
- Making a bucket public to fix a loading issue and never reverting it.
- Permissive Firebase Storage rules or Supabase bucket policies.
- Storing private user files in a bucket meant for public assets.
Check it yourself
Open a storage URL from your app in a private browser window. If you can open private files or see a full file listing, access is too broad.
Mitigation
- Separate public assets from private user or operational files.
- Disable listing unless it is intentionally part of the product.
- Use signed URLs, storage policies (Supabase), or Storage rules (Firebase) for private objects.
- Review object names and sample files before launch; names alone can leak customer or internal context.
Reality check
A reachable bucket is not always a vulnerability. NullFault raises it so you can confirm whether public access matches the product design.