How do I store and serve files securely?
- Public media: versioned keys, responsive image formats, cache-control headers, CDN, sensible size limits
- Sensitive files (IDs, payroll, verification documents): a private bucket, authorise first, then issue a short-lived signed URL; audit downloads where required — never expose them as public media
- Uploads: detect the real content type, allowlist extensions, limit size, generate safe key names, scan untrusted documents for malware, and never host user-uploaded executables
- Lifecycle: retention, versioning, deletion policy, encryption, restore tests, access logs and an egress cost forecast
- Images: strip EXIF/GPS metadata and re-encode before storing