I was thinking the same. What we have here is a security nightmare. You have executable code on globally unique URLs with no protective mechanisms in front of it except for the ability to do IAM. Yikes.