Demo article for reviewing the website layout.
Classify your objects
Decide which files are intentionally public. Images used by a public website have a different access requirement from private documents or course recordings.
Separate access boundaries
Use separate buckets for public and private content. A folder name alone does not create an access boundary. Keep storage credentials on the server and scope them to the intended bucket.
Review and monitor
Check bucket permissions, domain configuration and request logs. Revisit access after changes and verify private objects cannot be fetched anonymously.
