How the file storage check works

Many sites keep images, downloads or customer uploads in cloud storage, such as an Amazon S3 bucket. The files your pages link to are meant to be public. The bucket's file list usually is not: if anyone can ask the bucket for a list, they can find every file in it, including invoices, exports or backups that were never linked anywhere.

What it reads

• The addresses of storage buckets named in your home page, up to two linked pages and your own script files (already fetched for other checks): Amazon S3, Google Cloud Storage, Azure Blob Storage and DigitalOcean Spaces.
• For up to 3 buckets, one anonymous listing request each, the same request anyone on the internet can make. Nothing is downloaded from the bucket, and no file is opened.

What it reports

• A bucket that allows public listing: it answered with a file list. The report says which bucket and how many file names the first page of the list held. The file names themselves are never stored.

A bucket that refuses the listing (the normal, safe setting) is not mentioned. Files in it can still be public one by one; that is how a CDN bucket works and is not a finding.

What it cannot see

• Buckets your pages and scripts do not name, and buckets beyond the first three (the report says when there were more).
• What is in a listable bucket, and whether any of it is sensitive. Only you can judge that.
• Access rules for uploading or deleting. The check never tries either.

What to do with the result

Ask your developer or whoever manages the cloud account to turn off public listing for the bucket while keeping the public files readable. On Amazon S3 that means removing s3:ListBucket for everyone from the bucket policy (or turning on Block Public Access if nothing in the bucket needs to be public); the other providers have an equivalent setting. Then look through the bucket for files that should not be there.