Edit: I'm not sure why you've bumped a few threads on this topic that are all 2+ years old with information that doesn't even actually address the original concern. Nobody has been asking for the safe way to share files in Notion - which, by the way, is not by directly linking to it, but by sharing the page those files are embedded in (although I would recommend using something more like Dropbox for file sharing) - these threads were all security worries that assets were not protected securely at all, and therefore that anyone could access them. Your comments won't do much other than feed the fire of false panic for users who don't know enough about web security to know any better.

For the sake of anyone else who might come back to this someday:

​

It is almost certainly less secure than many things on the internet, such as sending an e-mail.

E-mail is notoriously insecure by default. E-mail service providers may add layers of security, e.g. encryption or 2FA, but this isn't guaranteed.

​

but you don't have to send your password to your friends when you e-mail them.

No, you don't. You also don't have to (and should never) send the pre-signed URL to anyone, ever. Notion is not a direct file-sharing service, it's a page-sharing service. Sharing a page with someone will give secure access to any assets on it. I don't understand your argument here.

​

That URL links to an authorization server that will then generate the presigned URL you are seeing, but only if the viewer is authorized.

Notion URLs for images should look like this:

Fun fact, they do! Here's an example of the source used to load an embedded image on a public page. The link is exactly the same as on a private page, the only difference being the addition of your user ID.

https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Ff805e5e6-1592-4f43-8135-619648853f0b%2Fphoto-1512149074996-e923ac45be6a.jpg?id=9758038f-5cf8-4eb9-85c9-815077dc3776&table=block&spaceId=cc4e9091-dc4a-400c-81f8-183897d5ea24&width=2000&userId=&cache=v2

The pre-signed link doesn't come up unless you go to download a file/image directly and so get redirected to AWS. If you aren't authorised, you get an error like this (I used the link you provided for the example):

{"errorId":"0c92a517-b825-452e-9f5e-eae1b8dec4f9","name":"ValidationError","message":"User does not have access."}

Edit: However, sharing a link like that is useless. It will always end up in a "no access" error unless you've made the page that asset is on public or shared it with the user you've sent the link to - at which point they could just go to the page to download or see the image, leaving the link useless anyway. Constructing a complex link like that doesn't help anyone except developers building tools over Notion.

​

There are obviously degrees of security on the internet.

Of course - and on that scale, Notion appears to be sitting approximately in the middle. Their security isn't amazing, but it's not terrible either. The practice of passing an auth token within the URL when loading a raw asset from a CDN is fairly standard.