# Remind Secures Shared Content with Signed CDN URLs and a Private S3 Bucket

DevFeed: [Remind Secures Shared Content with Signed CDN URLs and a Private S3 Bucket](<https://devfeed.tech/articles/remind-s-security-stance-in-action-31931.md>)

Original publisher: [Read original article](<http://engineering.remind.com/reminds-security-stance-in-action/>)

Author: Remind

Published: 2020-07-07T00:00:00Z

Content type: opinion

Language: en

Sources: [Remind](<https://devfeed.tech/sources/remind.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>)

Tags: [amazon-s3](<https://devfeed.tech/tags/amazon-s3.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [cloudfront](<https://devfeed.tech/tags/cloudfront.md>), [files](<https://devfeed.tech/tags/files.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Remind describes how a bug bounty researcher's report led to changes in its content-sharing security. Content delivered through its CDN is now signed and expires after seven days, while the Amazon S3 bucket is private to prevent random access and protect content UUIDs.

## Source excerpt

At Remind, we help educators communicate with millions of students and families. These connections are critical for supporting student learning, especially with school closures this year, and it's equally important for all of the communications on our platform to be secure, protected, and reliably delivered. As part of our security stance, we engage the security researcher community via a bug bounty program--which is how a recent collaboration with a researcher helped us identify improvements to user safety while maintaining the essential content-sharing function of our platform. First, some background: Along with messages, the Remind platform allows users to share content--like assignments, flyers, newsletters and other materials and resources--in their classes, schools, and districts. Files are uploaded to Remind and stored in Amazon S3 and served via our Amazon Cloudfront CDN, as is practice for many other companies. But unlike other platforms, a significant percentage of Remind users only receive content via SMS text notifications. To make sure that students and families could access this content directly from their text messages, especially if they had limited data or couldn't download our app, we made the decision many years ago to make files publicly accessible in an approach generally similar to the one used by a number of social networking applications: Files were obscured behind a randomly-generated UUID but could otherwise be accessed by anyone with the relevant UUID. Recently, we received a researcher submission challenging the security of our content-sharing implementation. As a result of the researcher's report and the improvements we made, content distributed via Remind's content delivery network (CDN) is now signed and automatically expires after 7 days; our S3 bucket is also now private, preventing random access. These enhancements prevent brute-force attacks on our S3 bucket aimed at discovering content UUIDs and further protect these UUIDs against le