Status: IN
Two data-plane isolation gaps exist in the implementations: BCC recipients are stored alongside to/cc in the email record, which could leak BCC information to other recipients in a real system, and the presigned URL signing secret is generated once at class level rather than per instance, so all ObjectStorage instances in the same process share a single HMAC key — widening the blast radius if that key is compromised.
Security permissiveness extends beyond access control into data isolation — information leaks through stored BCC and shared secrets, not just through missing authorization checks
Depends on (SL): email-service-bcc-stored-in-record, s3-presigned-secret-is-class-level