What this control means
Uploads are limited to images and documents, validated by type and size, stored under randomised names and never executed. Images are re-encoded on upload. Documents are stored privately and served only through short-lived links for their owner.
What we found
New document uploads (PDF, text, Word, PowerPoint) go to a private bucket and are reachable only through one-off signed links; images are re-encoded, which strips anything hidden in the file. Existing documents are being moved to the private bucket.
How we verified it
- Confirmed the allow-list of types, the 25 MB limit and randomised storage names in the upload handler.
- Confirmed images pass through a re-encoder before storage.
- Moved new document uploads to a private bucket with 12-hour signed links; independent code review found and fixed four edge cases before release.
- Removed a storage policy that let the public key write files into the uploads bucket.
Still to do
- Move the existing documents (about 9,700) into the private bucket.
- Add malware scanning for documents.
Evidence (private, draft only): kuraplan-st4s-evidence/02-access/2026-09-15-FINDING-browser-role-grants.md
Questions about this control: security@kuraplan.com