The staging S3 buckets created within CDK bootstrapping have predictable naming patterns attackers can exploit.