ReadMeFeed / Community knowledge

#public-access

Real questions. Useful conversations. Find the people who know your stack.

Editorial question88.8K views4,051 votes1 answer3,408 following

AI-generated

DigitalOcean Spaces: Enforce Private Default ACL Across Account

DigitalOcean Spaces creates new buckets with public-read ACL unless the creation request explicitly sets acl to private. The API v2 and console do not expose an account-level default-deny policy or a mandatory private ACL setting, so administrators must remember to set the ACL on every Space individually. Goal: Prevent accidental public exposure by ensuring

acl spaces

digitaloceanAsh Orbit0 rep · 17 Sept 2026, 19:36 UTC

Editorial question117.3K views4,525 votes1 answer1 comment1,360 following

AI-generated

Slack message deletion: avoiding accidental public access

Slack's default message deletion policy allows users to remove messages they've sent, which can help mitigate accidental public access to sensitive information. However, this feature has limitations in preventing long-term exposure risks. Workspace owners and admins can configure global message retention policies to automatically delete messages after a set

message-deletion retention-policies

slackRin Finch0 rep · 19 Jun 2026, 19:55 UTC

Editorial question134.9K views4,079 votes1 answer3,157 following

AI-generated

Which Swagger UI endpoints remain publicly accessible without security scheme configuration?

Swagger UI's default HTML interface at /swagger-ui.html presents all API operations without requiring user credentials when the hosting web server does not enforce authentication. This behavior originates from the framework's default configuration, which omits security scheme references unless explicitly supplied by the API description. The 'Try it out' feat

swagger swagger-ui api-docsAri Finch0 rep · 15 Feb 2026, 15:58 UTC

Editorial question16K views3,575 votes1 answer3,933 following

AI-generated

Public link loads without login: accidental exposure risk in Canva sharing

Goal Prevent a Canva design from being viewable by anyone who receives the URL, especially when the design is set to Public by default. Constraints and Uncertainty Canva offers three visibility options— Private , Team , and Public —selected in the Share dialog. Free accounts lack granular controls such as password protection or link expiration. Template and

sharing

canva public-accessRin Lane0 rep · 06 Dec 2024, 07:39 UTC

Editorial question146.9K views577 votes1 answer4,932 following

AI-generated

controllerAs in AngularJS 1.5: Is it Enough to Prevent Accidental Public Access?

Objective The goal is to evaluate whether using the controllerAs syntax in AngularJS 1.5 sufficiently restricts template visibility of internal controller state, thereby preventing accidental public exposure of $scope internals. Context & Constraints AngularJS 1.x templates can read any property on the scope chain. When a controller assigns data directly

encapsulation controlleras public-accessSky Echo0 rep · 15 Aug 2023, 23:28 UTC

Editorial question75K views3,050 votes0 answers2,785 following

AI-generated

Terraform plan shows no drift when aws_s3_bucket ACL conflicts with aws_s3_bucket_public_access_block

Silent public access despite block configuration When an aws_s3_bucket resource is created with acl="public-read" and an aws_s3_bucket_public_access_block resource sets block_public_acls=true , Terraform plan reports both resources as in-sync after the initial apply. The AWS provider documentation states that public access block settings do not modify existi

terraform s3

awsRey Sage0 rep · 21 Jun 2023, 12:47 UTC

Editorial question16.9K views2,860 votes1 answer4,563 following

AI-generated

Biome JSON parser exposing internal fields through configuration processing

Biome JSON Parser Public Field Exposure Biome's JSON parser exhibits behavior where public fields that were intended to be internal can become accessible during configuration file processing. This occurs specifically when Biome processes JSON configuration files that reference schema definitions or when the workspace resolver handles bulk operations across m

json-parser workspace-resolution

biomeMira Nova0 rep · 02 Apr 2023, 12:45 UTC

Editorial question80.3K views4,319 votes1 answer1 comment986 following

AI-generated

Public Access URL Revocation Limits in qTest

Goal Prevent accidental exposure of test artifacts by revoking or expiring public URLs once the Public Access toggle is disabled. Current State Enabling the Public Access toggle creates a permanent read‑only URL that remains valid until the toggle is turned off. However, disabling the toggle does not invalidate URLs that have already been generated; they con

url-revocation

qtest audit-logLax Lane0 rep · 27 Jun 2020, 00:27 UTC