Thank you for the report. We checked our Cloudfront distribution and enabled signed urls only.

The URLs are now time restricted and will not be accessible for longer than 1 day.