The Storage library support for Post Policy V4 has a security risk that is addressed in the latest PR to Storage conformance tests: googleapis/conformance-tests#31

The fix is to add {"bucket":"bucket-name"} to Post Policy V4 policy which is then signed.

Here's an example solution in Ruby: googleapis/google-cloud-ruby#5702