Context
User-supplied files are untrusted. Encore provides object storage backed by S3 on the owner’s AWS (0030), and AWS GuardDuty can scan S3 objects for malware.Decision
- Files go in Encore object storage buckets (S3), never in Postgres or on a service’s disk.
- GuardDuty malware protection scans every upload; an object is unreadable to users until the scan passes.
- Limits apply at upload: maximum size and an allowed content-type list per bucket. Values: TODO per product.
- Public buckets are not used; downloads use short-lived signed URLs.
Consequences
- Infected or oversized files are stopped before use; uploads have a pending state.
- GuardDuty adds AWS cost and scan latency.
Enforcement
Planned — an integration test that an unscanned object cannot be fetched; a validator check that no bucket is declaredpublic.