I agree. Even if its only public for one sec it should be considered compromised. However, everything is a risk management question, so knowing the amount of ti

I agree. Even if its only public for one sec it should be considered compromised. However, everything is a risk management question, so knowing the amount of time it was exposed is helpful for other orgs to determine their response to this incident. Same if there was an accesslog.