[returningfory2]

Or old code referencing the bucket _writes_ data to it, and the attacker can now read it.