How do I secure Supabase Storage buckets?

Supabase Storage uses the same RLS system as database tables, with policies defined on the storage.objects table. Each bucket can be set to public or private, where public files are accessible via URL without authentication and private files require a signed URL or valid JWT. Even private buckets need proper RLS policies to control who can upload, download, or delete files. Common mistakes include creating public buckets for user uploads or writing overly permissive policies that allow any authenticated user to access all files. UNPWNED tests observed anonymous access patterns exposed through the public application configuration. Complete bucket-policy correctness requires review in Supabase.