A temporary account and a visible storage listing

I created a temporary account to check what it could access. The storage service returned a list of object names and paths. I had not uploaded those objects through that account.

My report described a broader exposure than I had actually tested. It said the files could be downloaded. But I had stopped at the listing: I did not download user files, verify their contents or establish who owned each one. The list was evidence of accessible names and paths, not proof that every file behind them was readable.

That was still a specific result to report. A newly created account could obtain the listing, and the response exposed information about how the stored material was organised. The access check worth examining was whether being signed in was enough to receive that information. I did not have the server's rules, so I could not present my proposed explanation as its confirmed implementation.

I sent the report with the responses from my tests and deleted the temporary accounts. The first reply acknowledged the submission and gave an expected review period. The later reply said the security team had reviewed it and was already aware of the issue. There would be no reward.

That reply did not confirm every claim in my report or assign it a severity. It also did not say that a fix had shipped. I have not independently checked a fix or established what the service permits today.