Yandex Object Storage
Yandex Object Storage is S3-compatible and hosted at `<bucket>.storage.yandexcloud.net`. Bucket ACLs and object ACLs both apply, with the bucket-level `public-read` setting being the dominant exposure path.
Yandex Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Yandex Cloud's free-tier promotion encourages experimentation; many exposed buckets are dormant trial accounts that were never wound down after the project ended.
Real-world impact
Anonymous list and download of all objects. Often used as a free CDN by operators who didn't realize the cost and security implications.
Remediation
- Set bucket ACL to `private` via the `yc storage` CLI or web console.
- Delete dormant buckets after a project ends rather than leaving them on free tier.
URL patterns
Yandex Object Storage buckets typically resolve under hostnames like:
example.storage.yandexcloud.net
Check a specific Yandex Object Storage URL
Paste any Yandex Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Yandex Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request