Files and Assets
Public assets are intentionally downloadable by anyone. Workspace documents, exports, and platform-private files require a different storage and delivery boundary.
Upload Controls
Validate file size, extension, media type, and content expectations. Generate storage names independently of the submitted filename, preserve the original name only as controlled metadata, and reject executable or ambiguous formats that the workflow does not need.
Private files should be stored outside public web paths and delivered through a handler that verifies the current user and resource scope. Responses should set an appropriate content type, disposition, cache policy, and download name.
Operationally, scan uploads where risk warrants it, log outcomes without exposing file contents, and define retention and deletion behavior.