This deploy bypassed our API server.

Bytes went straight from sb → MEGA S4. The server only signed the URL.