Comment by Retr0id

Also, uploaded images are publicly reachable in plaintext and without auth: https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/c...