Bolt
storage
Cloud Storage Permissions Misconfigured in Bolt App
Your Bolt.new application fails to upload, read, or delete files from cloud storage. Users get permission denied errors when trying to upload profile pictures, access shared documents, or view images that should be publicly visible.
Cloud storage services like Supabase Storage and AWS S3 use policy-based access control. If these policies are too restrictive, legitimate operations fail. If they're too permissive, anyone on the internet can read or modify your files. Bolt's AI often generates storage code without configuring the bucket policies correctly.
This typically surfaces right after connecting cloud storage: uploads fail with RLS policy violations, images return 403 errors, or users can see other users' private files because the policies are set to public.
Error Messages You Might See
StorageApiError: new row violates row-level security policy
403 Forbidden: Access denied to storage object
Error: Bucket not found
StorageApiError: The resource already exists
Policy check failed for storage.objects
Common Causes
- Supabase RLS not configured — Storage bucket has Row Level Security enabled but no policies defined, blocking all operations
- Bucket set to private without access policies — The bucket is private (correct) but no policies allow authenticated users to upload or read their files
- Public bucket exposing all files — The bucket is set to public, letting anyone access any uploaded file including private user documents
- Wrong storage bucket name — Code references a bucket name that doesn't exist or is misspelled in the Supabase dashboard
- Service role key used on client — The Supabase service_role key bypasses RLS in development but the anon key used in production respects RLS policies
How to Fix It
- Create proper RLS policies — In Supabase dashboard, add storage policies: allow authenticated users to upload to their own folder (auth.uid()::text = (storage.foldername(name))[1])
- Set bucket visibility correctly — Use private buckets for user files and create signed URLs for access: const { data } = await supabase.storage.from('private').createSignedUrl(path, 3600)
- Use folder-based isolation — Store files in user-specific folders: uploads/{userId}/filename.jpg and restrict access by folder ownership
- Test with anon key — Always test storage operations with the anon key, not service_role, to catch RLS issues before production
- Add public bucket for assets — Create a separate public bucket for truly public assets like product images, and keep user uploads in private buckets
Real developers can help you.
Jen Jacobsen
I’m a Full-Stack Developer with over 10 years of experience building modern web and mobile applications. I enjoy working across the full product lifecycle — turning ideas into real, well-built products that are intuitive for users and scalable for businesses.
I particularly enjoy building mobile apps, modern web platforms, and solving complex technical problems in a way that keeps systems clean, reliable, and easy to maintain.
Franck Plazanet
I am a Strategic Engineering Leader with over 8 years of experience building high-availability enterprise systems and scaling high-performing technical teams. My focus is on bridging the gap between complex technology and business growth.
Core Expertise:
🚀 Leadership: Managing and coaching teams of 15+ engineers, fostering a culture of accountability and continuous improvement.
🏗️ Architecture: Enterprise Core Systems, Multi-system Integration (ERP/API/ETL), and Core Database Structure.
☁️ Cloud & Scale: AWS Expert; architected systems handling 10B+ monthly requests and managing 100k+ SKUs.
📈 Business Impact: Aligning tech strategy with P&L goals to drive $70k+ in monthly recurring revenue.
I thrive on "out-of-the-box" thinking to solve complex technical bottlenecks and am always looking for ways to use automation to improve business productivity.
Alvin Voo
I’ve watched the tech landscape evolve over the last decade—from the structured days of Java Server Pages to the current "wild west" of Agentic-driven development. While AI can "vibe" a frontend into existence, I specialize in the architecture that keeps it from collapsing.
My expertise lies in the critical backend infrastructure: the parts that must be fast, secure, and scalable. I thrive on high-pressure environments, such as when I had only three weeks to architect and launch an Ethereum redemption system with minimal prior crypto knowledge, turning it into a major revenue stream.
What I bring to your project:
Forensic Debugging: I don't just "patch" bugs; I use tools like Datadog and Explain Analyzers to map out bottlenecks and resolve root causes—like significantly reducing memory usage by optimizing complex DB joins.
Full-Stack Context: Deep experience in Node.js and React, ensuring backends play perfectly with mobile and web teams.
Sanity in the Age of AI: I bridge the gap between "best practices" and modern speed, ensuring your project isn't just built fast, but built to last.
BurnHavoc
Been around fixing other peoples code for 20 years.
Omar Faruk
As a Product Engineer at Klasio, I contributed to end-to-end product development, focusing on scalability, performance, and user experience.
My work spanned building and refining core features, developing dynamic website templates, integrating secure and reliable payment gateways, and optimizing the overall system architecture.
I played a key role in creating a scalable and maintainable platform to support educators and learners globally.
I'm enthusiastic about embracing new challenges and making meaningful contributions.
Jacek Rozanski
Senior PHP/Symfony developer and DevOps engineer with 20+ years of professional experience, running opcode.pl (web development agency, est. 2004).
Day job: I'm the sole backend developer at merketing company where I own and maintain 11 PHP/Symfony microservices on AWS (ECS Fargate, RDS, S3, CloudFront), handle the full CI/CD pipeline (Bitbucket Pipelines, Docker), and manage monitoring with Sentry and CloudWatch. These services handle high request volumes in production every month.
What I bring to AI-built apps:
- I audit and fix security issues (OWASP methodology), performance bottlenecks, and architectural problems in codebases generated by Cursor, Claude Code, Lovable, Bolt, and v0
- I refactor AI-generated prototypes into production-grade applications with proper error handling, testing, and clean architecture (SOLID, DDD, hexagonal architecture)
- I set up the infrastructure AI tools don't touch: AWS hosting, CI/CD pipelines, automated deployments, database optimization, monitoring, and alerting
- I integrate external services: payment providers, email systems, partner APIs, SSO/auth
Tech stack: PHP 8.x, Symfony, React, Next.js, PostgreSQL, MySQL, Docker, AWS (ECS, RDS, S3, SQS/SNS, CloudFront), Terraform, Supabase. I also use AI tools daily (Claude Code, Cursor) in my own workflow, so I understand both the strengths and the gaps in AI-generated code.
Based in Poland (CET timezone). Available for async work and calls during EU/US business hours.
Costea Adrian
Embedded Engineer specilizing in perception systems. Latest project was a adas camera calibration system.
Stanislav Prigodich
15+ years building iOS and web apps at startups and enterprise companies. I want to use that experience to help builders ship real products - when something breaks, I'm here to fix it.
Taufan
I’m a product-focused engineer and tech leader who builds scalable systems and turns ideas into production-ready platforms.
Over the past years, I’ve worked across startups and fast-moving teams, leading backend architecture, improving system reliability, and shipping products used by thousands of users. My strength is not just writing code — but connecting product vision, technical execution, and business impact.
Jaime Orts-Caroff
I'm a Senior Android developer, open to work in various fields
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
Should my Supabase Storage bucket be public or private?
Use private buckets for user-uploaded content (profile photos, documents). Use public buckets only for assets that genuinely need to be accessible to anyone (product images, marketing assets). Always configure RLS policies regardless of visibility.
Why does storage work in development but not production?
In development, you might be using the service_role key which bypasses all RLS policies. In production, the anon key is used and respects RLS. Create proper storage policies that allow authenticated users to manage their own files.