DigitalOcean Spaces
DigitalOcean Spaces is an S3-compatible object store. The misconfig surface mirrors S3 almost exactly: the same `GET ?list-type=2` enumeration applies, against the `<region>.digitaloceanspaces.com` regional host.
DigitalOcean Spaces exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Spaces buckets are private by default but the UI offers a one-click "File Listing: Enabled" toggle that exposes the manifest. Many developers flip it on while debugging and never flip it back.
Real-world impact
Public listing leaks every object name and size, which is enough to download anything stored without a CDN signing layer in front.
Remediation
- Disable "File Listing" in the Space settings unless the bucket is genuinely a public directory.
- Use a CDN endpoint with signed URLs for distribution, not direct bucket reads.
URL patterns
DigitalOcean Spaces buckets typically resolve under hostnames like:
example.nyc3.digitaloceanspaces.comexample.fra1.digitaloceanspaces.com
Check a specific DigitalOcean Spaces URL
Paste any DigitalOcean Spaces URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed DigitalOcean Spaces bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request