[gfs]

As far as I know, bucket names must be unique at other providers like AWS as well. [0]

I'm no expert but to try and protect my own domain, I use a transform rule to match a subdomain and append "/file/$MY_BUCKET_NAME" to each request. This should return a 404 for anybody who tries to inject their own bucket in the path. I could be wrong of course.

[0]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket...

[eropple]

Bolting a Cloudfront distribution onto a S3 bucket is pretty well-trod territory, though, and doesn't have these sharp edges. (Has a couple other ones, but they're less common.)