s3://linn.cloud.news.attachments/ is publicly accessible

Whilst the main bucket does not have List permissions for public, all objects within are publicly readable. Anybody is able to perform an aws s3 cp on the object.