[candiodari]

... and has had security incidents

http://www.behind-the-enemy-lines.com/2012/04/google-attack-...

[charleslmunger]

I don't see any mention of Apps Script in that blog post.

[kyrra]

TLDR: someone linked to all the images of an S3 bucket from google sheets, and Google proxies loading the images through Google (smart security process). The worst thing here may be that google ignored the Cache-Control returned by S3.

Where is the actual security incident?