A 'Hidden' S3 URL Isn't Access Control — Short-Lived Signed URLs Are
TIL that a private-looking direct download URL for a purchased file is still a public URL forever, and the fix is generating a signed, expiring link on demand after checking ownership server-side.
#Next.js