> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackra.figentra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 0034 — Encore object storage, GuardDuty malware scan, upload limits

> Proposed · 2026-10-19

## Context

User-supplied files are untrusted. Encore provides object storage backed by S3 on the owner's AWS ([0030](/adr/0030-encore-cloud-on-owner-aws)), and AWS GuardDuty can scan S3 objects for malware.

## Decision

1. **Files go in Encore object storage buckets** (S3), never in Postgres or on a service's disk.
2. **GuardDuty malware protection scans every upload**; an object is unreadable to users until the scan passes.
3. **Limits apply at upload**: maximum size and an allowed content-type list per bucket. Values: TODO per product.
4. Public buckets are not used; downloads use short-lived signed URLs.

## Consequences

* Infected or oversized files are stopped before use; uploads have a pending state.
* GuardDuty adds AWS cost and scan latency.

## Enforcement

Planned — an integration test that an unscanned object cannot be fetched; a validator check that no bucket is declared `public`.

## Supersedes and sources

Supersedes: none. Sources: owner decisions in chat, 2026-10-19.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.