Files & CDN

A place to keep the bytes the database should not hold, backed by the platform's global CDN. Declare a store once, at module scope, as private or public. A private file is served from an isolated origin, reachable only through the app session or a short-lived signed link, so nothing a user uploads can execute on the app's own domain. A public file is served from the CDN close to the user, cached per put, and if it is an image it resizes on the fly through query params, so a page requests the size it displays instead of scaling the original.

Every file written to a store is scanned automatically as it lands: malware with ClamAV, and personal information with Microsoft Presidio wherever the file carries text. Findings surface per file in the platform's Files dashboard, with nothing to configure. The one to act on is PII in a public store, since a public object is fetchable by anyone from the CDN. In a private store, that same finding sits behind the app's own access control already.

User uploads go straight to storage: a method mints an upload token, the browser uploads against it, and the bytes never touch the app's backend. One store is shared across dev and prod on purpose, so a file put in development is the same object, at the same URL, in production. Keys default to a UUID, so writes never collide unless you choose a fixed key, which is then the only thing a later write can overwrite.