So exclude them

How?

How will they know a short link to a random PDF on S3 is potentially sensitive info?