Haunted buckets: Ember checks your Supabase Storage

When a Supabase Storage bucket is Public, anyone with a file URL can download it. Fine for logos. Scary for invoices, IDs or private photos.