Currently any files posted into a task are visible publicly which is a serious risk to the security of the confidential data that might be posted into ClickUp. I tested by uploading a png file into a clickup task and then tried to open it from another browser without session and incognito mode and in both I was able to download the file.