Hey all. I’ve noticed that even when an item in directus_files is not accessible via the public policy, if you have the ID of a file, you may access it at /assets/:id.
Is this intentional, or do I have an issue with my permissions? Public has no read permissions. I understand that a user wound have no access to the id in the first place without permissions, but that did not seem like a good reason to me for the file to be publicly accessible via /assets.
Thanks for any guidance!