A bucket policy blocks public reads, but the legacy website endpoint still exposes content through an old object ACL

The new policy appears strict, yet one access path bypasses it because object-level permissions were left behind from the static site era.