How do I secure Supabase Storage buckets?

Supabase Storage uses the same RLS system as database tables, with policies defined on the storage.objects table. Each bucket can be set to public or private, where public files are accessible via URL without authentication and private files require a signed URL or valid JWT. Even private buckets need proper RLS policies to control who can upload, download, or delete files. Common mistakes include creating public buckets for user uploads or writing overly permissive policies that allow any authenticated user to access all files. UNPWNED analyzes your Supabase storage configuration and identifies buckets with missing or weak access policies.