fix: bucket permission should be set to private #1