# supabase/storage-policies

> Checks that every storage bucket in the project file has a policy on storage.objects that names it.

Checks that every storage bucket in the project file has a policy on storage.objects that names it.

Part of the [`supabase`](/reference/configurations/supabase/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

A bucket with no policy stays closed to every user, or open to anyone when public, and nobody recorded that choice.

## What to do

Add a policy on storage.objects for the bucket in a migration.

## Example

A storage bucket with no policy on `storage.objects` reports a finding. Add a migration that defines access for that bucket.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore supabase/storage-policies --paths "<glob>" --reason "<why>"
```