Yeah, this is very bad. We must not have these publicly accessible. Our dashboard can authenticate with blob storage to download them. Good catch Tim.