Supabase public buckets bypass signed URLs, exposing private files to anyone

·1 views

A technical advisory warns that Supabase Storage buckets marked as public allow anyone to access stored files directly via a stable URL, completely bypassing signed URL authentication. This poses a serious risk for developers building private B2B workflows — such as storing generated images in Next.js apps — who mistakenly assume signed URLs alone protect their content. The core issue lies in Supabase's public flag: when set to true, no authentication check is performed before serving objects. Developers are advised to set the bucket's public flag to false, apply row-level security policies, and serve files exclusively through time-limited signed URLs generated server-side. An optional recommendation is to offload CPU-heavy image processing to background workers while keeping all outputs in the now-secured private bucket.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Gemini Adds Third-Party App Connections for Bookings, Tasks and More

Google has announced a phased expansion of connected apps for its Gemini assistant, enabling users to plan, create, and complete tasks across third-party services from a single conversational interface. Named partners span productivity tools such as Granola and Otter.ai, booking platforms including OpenTable UK and Zocdoc, entertainment services like Ticketmaster, and music apps such as Pandora and iHeartRadio. The rollout is gradual and regional, meaning not all integrations will be available to every user simultaneously. Google has confirmed the partner list and broad categories but has not disclosed full availability details, activation steps, or whether linked services require separate paid subscriptions. The update represents a broader expansion of Gemini's connected-app ecosystem rather than a new AI model capability or end-to-end automation framework.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Waymo Adds Gemini AI Assistant to Ojai Robotaxis as a Rider-Only Feature

Waymo has launched a beta in-car conversational assistant called Gemini in Waymo, available to riders through a dedicated icon on the cabin screen. The feature allows passengers to use voice and natural language to adjust cabin settings, ask journey-related questions, and query general information about nearby places. Crucially, Gemini operates entirely separately from the Waymo Driver autonomous system and has no influence over driving decisions. The assistant remains inactive by default and only engages when a rider deliberately initiates an interaction, limiting its access to real-time trip data. Waymo framed the rollout, announced in July and updated in August, as part of a broader effort to enhance the in-cabin passenger experience rather than expand autonomous driving capabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DIY Smart Garden Irrigation System Built for Under £10 Per Zone

A mechanical engineer has shared a detailed guide for building a modular, automated home garden irrigation system at a cost of under £10 per zone. The project was motivated by the tedious task of hand-watering vegetables and flowers during hot summers, and a desire to apply home automation technology. The system uses 12V solenoid valves, a fused 12V power supply, and a Wi-Fi smart relay to control water flow across multiple garden zones. Components were sourced primarily from AliExpress and are designed to be modular and easily replaceable. The builder notes future plans to migrate control to an ESP32 with Home Assistant integration, removing the dependency on an internet connection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BlocSignal 1.1.0 Lets Flutter Devs Drop FutureBuilder With One Method Call

The bloc_signals 1.1.0 library introduces universal adapter extensions that let Flutter developers convert any Dart Future, Stream, or Signal into a synchronous BlocSignalBase container using a single method call. The update aims to eliminate the architectural friction that historically made FutureBuilder and StreamBuilder the default choice for handling async data inside widget trees. Two adapter methods are provided: .toBlocSignal() for raw domain values and .toAsyncBlocSignal() for full lifecycle state tracking covering loading, data, and error phases. The library's author has long argued that placing asynchronous builders directly in Flutter's build() method is an anti-pattern, a concern he previously raised with the official Flutter team. With this release, migrating from in-view asynchronous builders to structured state management is intended to be a largely mechanical, low-boilerplate process.

0 comments Read more at DEV Community