r2.dev domain public access error bucket files not reachable fails

Not specified by the original author.

TL;DR: Do not build production traffic on it. ## The failure modes - Assuming a bucket is public because the Worker can read it: Worker access uses the R2 binding (private, authenticated), which has nothing to do with public HTTP access. - Using r2.dev in production: it is documented for non-production use; rate limits and availability expectations differ. - Exposing a bucket publicly and then writing sensitive files to it later: public means public, including future objects.

Fix

1. Never mix. - For private files served to users, use presigned URLs or serve through a Worker with the R2 binding, not public access. - After enabling public access, verify from an unauthenticated session:. Expected: this specific failure stops.

Details

R2 public access By default, R2 buckets are never publicly accessible. assets.example.com . This is the production path. 2. r2.dev subdomain (non-production only): Cloudflare-managed subdomain for testing and development. Keep separate buckets for public assets and private data. ## Checklist - One bucket for public assets, another for private data. curl the URL without any credentials.

When to use

You hit exactly this: R2 public access: custom domain vs r2.dev, and the default-deny in R2 public access.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

R2 public access.

Root cause

Public access requires an explicit choice, which is the safe default: nothing leaks by accident. ## Two ways to expose a bucket 1.

Edge cases

• Custom domain (production): serve the bucket from a domain you control, e.g.

Verified against the live R2 Public buckets doc (updated Sep 25, 2026): buckets private by default, custom domain vs r2.dev (non-production), explicit enable required. Ref: https://developers.cloudflare.com/r2/buckets/public-buckets/

Not specified by the original author.

TL;DR: Buckets are private by default, which is the safe starting point. ## 2. # Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals.

Fix

1. Buckets are private by default, which is the safe starting point. ## 2. Expected: this specific failure stops.

2. subdomain is for non-production use only. Expected: this specific failure stops.

3. Verify from an unauthenticated session that the assets load with no credentials. ## 3. Expected: the value or setting is exactly right, nothing ambiguous.

4. Upload pipeline Uploads go through your app (or a Worker with the R2 binding) with content types set correctly: a missing. Expected: this specific failure stops.

5. Verify. Expected: the value or setting is exactly right, nothing ambiguous.

6. The Worker path also lets you add transforms (resizing, format negotiation) at the edge. ## Checklist - Public and private buckets separated from day one. - Custom domain in production, content types correct, cache HIT verified. - No sensitive file ever lands in the public bucket. Expected: this specific failure stops.

Details

Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals. assets.example.com ). The r2.dev Content-Type serves downloads instead of images. Fingerprint filenames for immutable caching. ## 4. CF-Cache-Status: HIT on repeat loads from multiple regions. ## 5. Private originals Serve private files via presigned URLs or through a Worker that checks auth and streams from the R2 binding.

When to use

You hit exactly this: Workflow: serving media from R2 with a custom domain and cache in Workflow.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Workflow.

Root cause

Public means public, including future objects: never mix.

Edge cases

• Custom domain for production Expose the public bucket on a custom domain (.
• Cache rules Long edge TTLs on the fingerprinted assets; the custom domain's cache behavior tuned per path.

Composite workflow grounded in verified docs: R2 buckets private by default, custom domain vs r2.dev (non-production), Cache Rules, R2 Workers binding for private serving. Refs: https://developers.cloudflare.com/r2/buckets/public-buckets/ , https://developers.cloudflare.com/cache/how-to/cache-rules/

Not specified by the original author.

Supabase Storage buckets: public vs private is a security decision, not a default

TL;DR

A public bucket serves files to anyone with the URL. That is correct for product images and wrong for user documents, avatars with PII, or anything access-controlled. Agents default to public because it makes uploads "just work", and the exposure is discovered later.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Steps

1. Create the bucket with the right visibility from the start. Migrating a public bucket to private breaks every hardcoded public URL, so decide before the first upload.

   Success check: the expected output above appears and the command exits 0.

2. Set file size limits and allowed MIME types on the bucket. Without limits, one abusive upload can fill the bucket or store executables you never wanted.

   Success check: the expected output above appears and the command exits 0.

3. For private buckets, no file is reachable without a policy or a signed URL. That is the point. Plan the access path (policies for in-app access, signed URLs for sharing) before creating the bucket.

4. Name buckets per domain (avatars, invoices, product-images), not per user. Per-user buckets do not scale and complicate policies.

   Success check: the expected output above appears and the command exits 0.

5. Enable the RLS policies on storage.objects for every bucket you care about. Buckets without policies are either fully open or fully closed depending on visibility, with nothing in between.

   Success check: the expected output above appears and the command exits 0.

Compatibility

Tool: Supabase. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Supabase Storage buckets: choose public or private deliberately

Quick test

Upload a file to the new bucket, then try to fetch it with no auth in an incognito window. Public buckets should serve it; private buckets must 403. If a private file loads anonymously, the bucket or its policies are wrong.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/storage