Further, sometimes users aren't truly aware of the implications of what making a bucket "public" means. Heck, maybe the original use-case wasn't too concerning,

Further, sometimes users aren't truly aware of the implications of what making a bucket "public" means. Heck, maybe the original use-case wasn't too concerning, but it changed over time. The folks writing/reading from the bucket are also likely distinct from those setting up the infrastructure - although that's (thankfully) not always the case these days, it certainly can still be. This reminds me of how React has a dangerouslySetInnerHTML[1] API - sometimes it's the hammer you need, but the name should (hopefully?) cause pause. [1]: https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml https://reactjs.org/docs/dom-elements.html#dangerouslysetinn...