Free tools Windows power users keep installed
One-click scans. No signup required.
An offline review of documented AWS storage settings reported 47 findings across Mastodon, Discourse, and Chatwoot. It did not scan live servers or AWS buckets, so those numbers describe modeled configurations—not confirmed vulnerabilities or proof that any particular deployment exposes data. The practical lesson is that an application’s S3 settings and the AWS account and bucket controls around it are separate layers, and both need review.
What did the scanner actually examine?
In an article published October 2, 2026, Bala Paranj describes cloning each project’s source, extracting AWS-related settings from configuration files and documentation, converting documented defaults into JSON snapshots, and evaluating those snapshots against Stave’s control catalog. The workflow did not use AWS credentials or contact running infrastructure. The snapshots represent what a deployer might get by following the documentation without additional hardening; operator choices can produce a different result.
As an Amazon Associate I earn from qualifying purchases.
Paranj explicitly framed the work as configuration analysis rather than a vulnerability disclosure, writing: “This isn’t a vulnerability disclosure. These projects work exactly as documented. The problem is the documentation.” That is the author’s characterization, not an official statement from the projects. Read Paranj’s October 2, 2026 article.
What did it report for each project?
| Project | Findings reported | Storage behavior described in the analysis | Mitigation or evidence limit |
|---|---|---|---|
| Mastodon | 16 findings in the modeled snapshot | The article identifies a public-read S3 permission default as its most serious application-level finding. | Paranj says setting S3_PERMISSION to an empty string disables ACL use in the cited configuration. Verify the project version and your deployment’s effective settings before applying that advice. |
| Discourse | 16 findings in the modeled snapshot | The article attributes public-read behavior to s3_use_acls being true while secure_uploads is false. |
The article suggests enabling secure uploads or disabling S3 ACLs. These setting claims are attributed to Paranj’s analysis; they were not independently confirmed against current official Discourse documentation here. |
| Chatwoot | 15 findings in the modeled snapshot | The article says the analyzed Active Storage configuration does not specify an ACL, leaving objects private by default. | That is a safer object-level pattern in the snapshot, not a substitute for bucket or account safeguards. Chatwoot’s self-hosting page lists AWS as a destination and showed v4.18.0, released September 18, 2026, as latest at the time of the analysis. |
The combined total—47—is the scanner’s output for these three offline snapshots, not a prevalence estimate or a tally of confirmed deployed vulnerabilities. Chatwoot’s deployment options and the version information above are on its Self-Hosted Chatwoot Deployment Guide.
#1 Best Overall
- Large format scanner - Helps improve access to and management of all your large files
- Has a color depth of 32-bit
Why can app settings and AWS safeguards disagree?
An application can specify how it uploads an object, including whether it requests an ACL, while account- and bucket-level controls govern what the bucket permits and how it is protected. A private-by-default object configuration does not by itself establish that public access is blocked at every level, encryption is enforced, or recovery controls are in place. Conversely, a bucket’s safeguards may restrict behavior an application expects. The effective posture depends on the combination and on deployment-specific overrides.
In the snapshots, Paranj reports that the Stave catalog identified absent account- and bucket-level protections across the analyzed setups. The reported inventory includes:
Rank #2
- Account- and bucket-level S3 Block Public Access protections, including the four Public Access Block settings.
- Default encryption and enforcement of HTTPS for requests.
- Restrictions on network paths, bucket ownership controls, and access logging.
- Versioning, cleanup of incomplete multipart uploads, and governance controls.
- SSE-C not being disabled. The article describes a possible risk in which a principal with
s3:PutObjectwrites an object encrypted with a customer-provided key that the owner does not have.
These are reported control-catalog results for JSON snapshots. They do not establish that a real bucket lacked a control, that an attacker used SSE-C, or that anyone read or encrypted data. The article evaluated S3 only; it did not assess Discourse’s SNS, MediaConvert, or Bedrock integrations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should operators use these findings?
Treat the project findings as a reason to inspect your own effective configuration, not as a diagnosis of every installation. Start with the deployed application version and the actual environment, then review AWS account and bucket controls independently. Apply changes in a way that preserves the access your service genuinely needs.
Rank #3
- Standalone network scanner with scanning speeds of 25 ppm/50 ipm (A4 portrait, 200/300 dpi), ADF capacity of 50 sheets
- PC-less scanning with large touch screen and on-screen keyboard
- Supports scanning from thin paper to thick paper, and plastic cards
- Security measures include Login Authentication with custom job menus, Encryption, Data Transmission Security, and more
- USB port to connect devices like a mouse or contactless IC card reader
- Confirm the application’s effective storage settings. Compare deployed values with the relevant version’s documentation and configuration, including environment overrides and operator changes. For Mastodon and Discourse, specifically verify the ACL and upload settings described in the table rather than assuming a documented default matches your instance.
- Review account and bucket public-access protections. Check the account-level and bucket-level Public Access Block configuration. Validate whether any public media or other intentional public access depends on exceptions before tightening controls.
- Set encryption and transport requirements deliberately. Review default bucket encryption and the bucket policy for HTTPS-only access. Test the resulting policy against the application’s actual upload and download paths before deployment.
- Plan logging and recovery controls. Consider access logging and versioning, and ensure the logging destination’s permissions and retention meet your operational needs. Configure cleanup for incomplete multipart uploads with a lifecycle policy appropriate to the workload.
- Validate access paths and ownership. Review network restrictions and bucket ownership controls against how the application and administrators reach S3. Avoid assuming a restrictive setting is harmless if it could disrupt legitimate service traffic.
- Recheck after changes. Exercise representative uploads and downloads, inspect the resulting permissions and encryption, and monitor logs. Use an AWS configuration review or scanner against your own account if you need to establish actual state; this article’s offline snapshots cannot do that.
AWS Prescriptive Guidance recommends limiting inbound access to authorized ports, using network layers and private subnets for resources that do not need internet access, avoiding the VPC default security group in favor of custom groups, and enabling Amazon Inspector to identify software vulnerabilities and unintended network exposure. These are broad infrastructure recommendations, not confirmation of the S3 findings in Paranj’s snapshots. See AWS Prescriptive Guidance on infrastructure security controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What do the findings not say about the rest of the stack?
They do not establish the security posture of a complete Mastodon, Discourse, or Chatwoot deployment. For example, Mastodon’s configuration guide says its web and streaming API processes bind to 127.0.0.1 by default and lists default ports 3000 and 4000; it also says secure mode is not enabled by default and describes compatibility, functionality, and caching trade-offs. Those application-level details do not prove that an AWS bucket is private or properly configured. See Mastodon’s environment configuration guide.
Likewise, a modeled default is not necessarily the current default in every release or the value active in a particular deployment. Confirm the version-specific documentation and inspect the AWS account and bucket actually in use before deciding that a reported condition applies.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
- FAST BUSINESS PRINTING AND COPYING: The Brother MFC-L5915DW business monochrome laser all-in-one printer delivers high-quality output and print and copy speeds of up to 50ppm(1) to help boost productivity and ensure fast, professional quality documents for busy offices.
- LOW-COST OUTPUT: Help reduce operating costs by using the Brother Genuine TN920UXXL ultra high-yield 18,000-page replacement toner cartridge. Includes a Brother Genuine 3,000-page toner cartridge(2).
- FAST, HIGH-VOLUME SCANNING: The 70-page capacity(3) auto document feeder offers single-pass, two-sided scanning up to 56ipm(4). Features a large document glass for up to legal-sized documents.
- FLEXIBLE CONNECTIVITY OPTIONS: Features built‐in Gigabit Ethernet and dual band wireless networking to seamlessly set up and share on your wired.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
