Even in a completely private instance, settings uploads like Logo and Favicon are presented in the login page and are considered public. Those are also frequently downloaded by tools that don’t auth, like websites doing OpenGraph embeds, PWA installs, Google results, etc.
1 Like