> How were they authenticating against S3 before? Judging by that URL, it looks like they were issuing a ListObjects? Public access is enabled for the bucket and this API is implicitly provided by S3.