anonymous access can copy secret file to public space