Uploaded files are readable by anyone with the link
Publicly readable object storage bucket
What this means
Your file storage is open for reading. Documents, scans and photos uploaded by users are available to anyone who knows or guesses the file address.
Why it matters
This storage usually holds the most sensitive documents: identity papers, contracts, medical records. The file listing is often open too, so nothing even needs guessing.
When this is not a problem
Storage holding images for a public website is open deliberately.
How to fix it
- Close public read access and serve files through short-lived links.
- Confirm the file listing is not available to outsiders.
Prompt for your AI agent
Disable public access to the file storage and serve files through short-lived signed links issued after checking the user's permissions.
How to verify the fix: open a file link in a private window — expect a refusal
References: cwe.mitre.org