As far as I can tell, private folders are also subject to this URL leaking problem, but in a somewhat limited way.<p>If someone can grab the URL to your "recent changes" RSS feed (events.xml), they can watch every file change you make, and view any image you upload, without being logged in to your account.<p>If anyone from Dropbox wants to correct me on this, or wants more details, my contact info is in my profile.