lena_ops Lena's guess is right. I made a test booking and looked at the image URLs: they contain /storage/v1/object/public/galleries/, so the bucket is public. That means two things.
The random folder name is the only protection, and it never expires. Couples forward the link, it lands in a family group chat, and you can't take it back short of renaming the folder.
Also check whether the bucket can be listed. If there's a select policy on storage.objects for galleries that allows anon, anyone can list every folder, and the long strings stop being secret at all.
What I'd do: make the bucket private, and have the gallery page look up the booking and create signed URLs server-side:
const { data } = await supabase.storage.from('galleries')
.createSignedUrls(paths, 60 * 60)The gallery link can stay a random token, just store it on the booking so you can revoke or regenerate it per couple.
yuki_builds yuki_builds