Lock down file storage holding user uploads
Tea dating-safety app breach leaked user IDs · Security incident · News · 404mediaco · Jul 2025
Selfies and driver's license photos from users of the Tea dating-safety app were posted on 4chan after the app's stored images were left exposed.
Lesson
Make storage buckets private by default, serve files through signed URLs and delete sensitive uploads you no longer need.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
My app uses Supabase (or Firebase) and I built it with Firebase. Please check whether my database is open to anyone. 1) List every table and storage bucket and whether Row Level Security (or security rules) is enabled. 2) For each table, explain who can read and write it now, in plain English. 3) Propose the minimum policies so users only see their own rows, public content is read-only, and plan, role or credit columns can't be changed by users. 4) Give me the SQL or rules to apply, and a test with two accounts and a logged-out browser. Don't use or ask for the service_role key. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: News ↗