Files and uploads

Required

• Confirm every upload on the server

  Required

  Keep a new file pending until the server has checked its size, type and checksum from the stored bytes. Never trust what the client reports.

• Scan files for malware before anyone opens them

  Required

  Scan every file that other people or systems will open, and serve it only after the scan says clean.

• Rebuild every uploaded image

  Required

  Decode each uploaded image, turn it upright, shrink it to a size limit and save it again as a new file without metadata. Never serve the original.

• Serve private files through short-lived links

  Required

  Keep the bucket private. Check access on every download request, then redirect to a signed address that expires within 5 minutes and sets safe download headers.

• Delete files when their owner is deleted

  Required

  Record every stored object in a files table with its owner, and delete the objects in the same job that deletes the owner.

• Neutralise formulas in spreadsheet exports

  Required

  In every CSV or spreadsheet export, prefix a single quote to cell text starting with =, +, -, @, a tab or a carriage return.

Recommended

• Upload straight to storage with a signed address

  Recommended

  Let clients send file bytes straight to object storage through a pre-signed address that your API issues, limited in size, type and time.

• Make large uploads resumable

  Recommended

  Let any upload over 100 MB, or any upload from a phone, continue from the last received byte after a dropped connection.

• Lay out storage by owner and let rules clean it

  Recommended

  Name every stored object by stage, owner and a random ID, with the stage as the first prefix. Let storage lifecycle rules delete what nobody needs.

Optional

• Store the same file once per owner

  Optional

  When users upload the same file often, store it once per owner under its SHA-256 hash and count the references.