---
title: "Supabase Storage: major performance, security, and reliability updates"
description: "Supabase Storage has shipped updates live in all regions for projects using Storage, targeting performance at scale, security vulnerabilities, and reliability issues. As projects reached tens of millions of objects, concurrent uploads exposed write bottlenecks, certain SQL deletes could orphan files, and a crafted path could escape the file backend’s storage root. The object-listing rewrite removes the prefixes table, six triggers, and twelve helper functions, derives folder structure from the objects table with a hybrid skip-scan algorithm, and uses cursor-based pagination; deep pagination on 60 million rows is up to 14.8 times faster without a write penalty. Direct SQL deletes are blocked by default through a statement-level trigger, while a configurable 30-second timeout supports cancellation of disconnected clients via native Postgres protocol. Idempotent migrations, TUS lock-race prevention, orphan-scanner fixes, OpenTelemetry metrics, and adapter and API bug fixes are included, with no code changes required."
---

# Supabase Storage: major performance, security, and reliability updates

[Supabase](https://yomu.fyi/company/supabase) · fabrizio · Mar 5, 2026

**Type:** Announcement

## Summary

Supabase Storage has shipped updates live in all regions for projects using Storage, targeting performance at scale, security vulnerabilities, and reliability issues. As projects reached tens of millions of objects, concurrent uploads exposed write bottlenecks, certain SQL deletes could orphan files, and a crafted path could escape the file backend’s storage root. The object-listing rewrite removes the prefixes table, six triggers, and twelve helper functions, derives folder structure from the objects table with a hybrid skip-scan algorithm, and uses cursor-based pagination; deep pagination on 60 million rows is up to 14.8 times faster without a write penalty. Direct SQL deletes are blocked by default through a statement-level trigger, while a configurable 30-second timeout supports cancellation of disconnected clients via native Postgres protocol. Idempotent migrations, TUS lock-race prevention, orphan-scanner fixes, OpenTelemetry metrics, and adapter and API bug fixes are included, with no code changes required.

## Context

Storage projects now hold tens of millions of objects. At that scale, concurrent uploads degraded write performance, certain SQL delete patterns could orphan files, a path traversal vulnerability affected the file backend, and support issues arose from stuck migrations, TUS locks, and related behavior.

## Approach / What changed

The release replaces the prefixes-table listing system with a hybrid skip-scan algorithm that derives folder structure from the objects table and uses cursor-based pagination. It adds path traversal prevention, statement-level protection against direct SQL deletes, query cancellation and timeouts, idempotent migrations, TUS lock checks, orphan-scanner controls, OpenTelemetry metrics, and multiple bug fixes.

## Takeaways

- Object listing no longer uses the prefixes table, six triggers, or twelve helper functions; cursor-based pagination on 60 million rows is up to 14.8 times faster for deep pages without a write penalty.
- A statement-level trigger rejects direct DELETE statements on Storage schema tables unless storage.allow\_delete\_query is enabled; the Storage API sets the variable automatically for normal operations.
- Storage metrics now use OpenTelemetry and can be pushed to any OTel-compatible backend, while Prometheus scraping remains available at /metrics through the OTel Prometheus exporter.

**Tags:** [Observability](https://yomu.fyi/topic/observability), [Performance](https://yomu.fyi/topic/performance), [Postgres](https://yomu.fyi/topic/postgres), [Reliability](https://yomu.fyi/topic/reliability)

- Source: [Supabase](https://supabase.com/blog/supabase-storage-performance-security-reliability-updates)
- Source URL: https://supabase.com/blog/supabase-storage-performance-security-reliability-updates
- Ingested by Yomu: 2026-08-29T04:00:55.816Z

[Read original post](https://supabase.com/blog/supabase-storage-performance-security-reliability-updates)