uploaded files / attachments are publicly accessible

[graik]

File uploads to S3 but also filesystem-based storage are non-private. Given the link, this content can be downloaded by anyone.

[graik]

possible reading:
https://github.com/RacingTadpole/django-private-media

There is an alternative solution for AWS / S3 storage using more involved permissions and policies. S3BotoStorage has a 'private' setting (off by default) and, for download, AWS_QUERYSTRING_AUTH lets AWS generate a temporary URL depending on authentication.