supabase/storage-policies
Checks that every storage bucket in the project file has a policy on storage.objects that names it.
Part of the supabase configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
A bucket with no policy stays closed to every user, or open to anyone when public, and nobody recorded that choice.
What to do
Section titled “What to do”Add a policy on storage.objects for the bucket in a migration.
Example
Section titled “Example”A storage bucket with no policy on storage.objects reports a finding. Add a migration that defines access for that bucket.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore supabase/storage-policies --paths "<glob>" --reason "<why>"