Passive Reconnaissance

Certificate transparency logs leak bucket names before the first API call

Block Public Access stops anonymous reads. It does nothing about the naming scheme an attacker has already rebuilt from your public TLS certificates, and that reconstruction leaves no log behind.