Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering

Our team noticed that you(program) can attach files to the policy page. These files can be anything, images, text, archive, etc.In other words, these files may or may not contain sensitive information. Our team believes that the data that can be attached in different vectors is high . Therefore, in …

https://hackerone.com/graphql
POST:
{"query":"query {team(handle:\"security\"){attachments{_id,content_type,created_at,expiring_url,file_name,file_size,id,long_lasting_url}}}"}