@nyanide That's possible, the simple policy only removes the attachment part of the object, so if you hide it behind a link that generates previews, you could probably bypass it. There are also probably other ways to cheese your way out of it.