I don’t know if this is a new issue, but we just noticed it too:
It seems like the image upload to the S3 bucket (cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com) happens as soon as the image is pasted. The embed check doesn’t happen until the post is submitted, but by then the image already exists in the bucket, and can be linked to with any of the following:
- Its S3 URL
- Its Discourse short URL
- Its generated
upload://URL (i.e., simply removing the!from the beginning of the autogenerated upload embed code)
I’m worried this means that even failed embeddings (i.e., attempted uploads that were subsequently denied) were still uploaded to the bucket, and are secretly counting against the site’s storage quota even if the uploader thought it was denied and nobody else can see the upload.