There is also an URL-signing oracle that allows any URL to be signed, so it's still possible to enumerate + download all files. Example: https://wjynmjluabqwqh

There is also an URL-signing oracle that allows any URL to be signed, so it's still possible to enumerate + download all files. Example: https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/sign/clipboard-images/7b407af2-f30c-4e37-adc7-b7bf48f2661b/1767204462210-Component_1__1_.png?token=eyJraWQiOiJzdG9yYWdlLXVybC1zaWduaW5nLWtleV80NTY1ZjE4Ni0zMmFhLTQ0YjAtYjFkMS1hMjdhNzY3NjIxODAiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJjbGlwYm9hcmQtaW1hZ2VzLzdiNDA3YWYyLWYzMGMtNGUzNy1hZGM3LWI3YmY0OGYyNjYxYi8xNzY3MjA0NDYyMjEwLUNvbXBvbmVudF8xX18xXy5wbmciLCJpYXQiOjE3Njc0MzE5MjYsImV4cCI6MTc5ODk2NzkyNn0.vUB-4-cGMGheIrFOkDLMuWMiGxMdhwJviAtK8V4-Pyo https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/s...