Are the images published in the Staff category publicly visible?

[patrickemin]

Today I published a post on my Discourse site in the staff category as an administrator. There was an image in this post. The URL for this image is publicly accessible. Is this normal? Thank you.

[Moin]

I think so. Otherwise, there would be no need for the secure-uploads feature:

Secure Uploads

Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance. Prerequisites You must have S3 uploads enabled on your site, which needs the following settings to be filled: S3 access key id S3 secret access key S3 region S3 upload bucket You also must be using an S3 bucket that does not have a Public bucket policy, and you need to make su…

[patrickemin]

Thanks I didn’t know that functionality