Meeting audio recordings uploaded to Supabase Storage with no documented encryption-at-rest or bucket ACL policy

[anshul23102]

Problem

Meeting audio recordings (captured via the Vexa bot transcriber) are uploaded
to Supabase Storage. The project does not document:

• Whether the Storage bucket is private or public.
• What bucket-level access policies restrict who can read uploaded audio files.
• Whether recordings are encrypted at rest beyond Supabase's default (which
  depends on the hosting region and plan).

If the bucket is accidentally set to public (a common Supabase misconfiguration),
anyone who discovers or guesses an audio file URL can download private meeting
recordings without authentication.

Meeting recordings contain highly sensitive business and personal information.
A data leak of this nature could have legal and compliance implications
(GDPR, CCPA).

Suggested Fix

1. Verify in BACKEND.md that the meeting recordings bucket is set to
   private in Supabase Storage, with no public access policy.
2. Add an RLS policy on the storage.objects table ensuring only the meeting
   owner (matching auth.uid()) can read their own recordings.
3. Document the bucket configuration in BACKEND.md with step-by-step
   instructions for contributors setting up the backend.
4. Add a setup verification step that checks bucket policies are correctly
   configured before allowing the app to function.

[anshul23102]

@AOSSIE-Org Could you please assign this issue to me? I'd like to work on it under GSSoC '26.
/assign
/claim