Currently even if the path to the media is set to private in our Schoolpress Blog, the media itself is not covered by the same protections. An authenticated user can still take the URL and send it out and anyone who is able to then access it, which bypasses the security in place.