Our HJ KB is set to internal only, meaning users must login in order to view content. I assumed that any media content (pictures, files and videos) that were uploaded to the KB would be secure to. I just found out I was wrong and that all media files are uploaded to S3 and if someone has the link to these files, they can access them. while this is unlikely, unlikely to be seen by anyone, this doesn't mean secure. We really need these file to be secured. At the very least, HJ should put a disclaimer on that setting page to insure admins changing that setting are aware of this security risk.