Hello,

As a result of #5621, Serverless-created buckets include a bucket policy that is supposed to deny any s3:* Action over that bucket, unless it is performed over HTTPS.

Unfortunately that Bucket policy is incomplete and still allows listing the Bucket content over insecure HTTP connection, if the Principal has permissions to perform that action.

Incorrect (current) Bucket Policy:

There is a gap in the docs about managing your installation using github settings and imgbot settings

Main points:
For managing your imgbot installation check out github's docs.
They offer 2 options for managing this. You can select which repositories you want it installed in, or you can choose "all repositories including all future repositories".

You can log in and see your repos and req

I'm getting "authLevel": "Anonymous" from using the new -a flag. This causes warnings from the JSON schema and has caused an issue with an app where it defaults back to function level when published. That last part strikes me as especially strange but would be a host issue. Regardless, the output from the Core Tools should be camelCased instead of PascalCased.