I don't know what Devin is but it sounds like this is just a case of using a high entropy uuid as a workspace address, it's not that different than password auth if, say, your password was in the query string. Not great, but basically it's "anyone with a link" method of sharing access.<p>Did Google Photos ever change their auth scheme? I know I was surprised once when I found out the direct URL of my jpegs was "public"<p>Here's an archived link to the Twitter thread you can read without an account <a href="https://xcancel.com/TheMidasProj/status/1867318553046921376" rel="nofollow">https://xcancel.com/TheMidasProj/status/1867318553046921376</a>