You can actually upload client-side encrypted data to S3 buckets. With one-time upload tokens. So what they are doing may be perfectly fine. Hard to tell witho

You can actually upload client-side encrypted data to S3 buckets. With one-time upload tokens. So what they are doing may be perfectly fine. Hard to tell without seeing the complete request.