Public file storage buckets
Vibe-coded apps store user uploads, profile photos, documents, receipts, ID scans, in a storage bucket. If the bucket is public, every file in it is one URL away from anyone, whether or not the file was ever meant to be shared.
What it looks like
Uploads work and images display, so the bucket looks fine. But the bucket is set to public, or its access rules are missing, so any file URL resolves for anyone, and file names or IDs are often guessable.
Why it matters
This leaks exactly the files people most expect to be private. A public bucket of uploaded documents can expose identity documents, financial paperwork, and personal photos in bulk. It is a data breach that never touches your database.
How ArgosX detects it
ArgosX checks whether your storage buckets and their objects are reachable without authorization, and flags files that a logged-out visitor can retrieve.
How to fix it
Make buckets private by default and serve files through authorized, expiring links.
- Set buckets to private and add access rules that check ownership.
- Serve downloads via signed, short-lived URLs rather than permanent public links.
- Do not rely on unguessable file names as your only protection.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.