When uploading, fedora-create-review should ensure that o+r permissions exist. I use a umask of 027, so uploaded files are not world-readable by default.
o+r
Fixed in 9ee94a74e0ae