If you are reading this over HTTPS on the beta domain, CloudFront is serving from the private S3 bucket through Origin Access Control.