Open storage buckets in Supabase

Make the bucket private. Add policies so authenticated users can only read and write a prefix that includes their user id.

create policy "own folder read"
on storage.objects
for select
to authenticated
using (
  bucket_id = 'uploads'
  and (storage.foldername(name))[1] = auth.uid()::text
);

Write the matching insert and update policies with with check. Serve files to the owner with a short-lived signed URL created on the server after you check the session. Do not generate signed URLs for any path the caller passes. Check the prefix first.