I guess. If the ad service let you create an ad consisting of another video, and you could embed a private video, that'd be pretty clear. This reminds me more

I guess. If the ad service let you create an ad consisting of another video, and you could embed a private video, that'd be pretty clear. This reminds me more of the Facebook bug where www.facebook.com had access control but mobile.facebook.com didn't. I don't really consider every endpoint to be a "deputy".