Files

Files attached to a workspace are stored privately and reached through signed URLs rather than public addresses. Every upload is checked before it is stored, and the checks are stricter than they look.

Type is decided by signature, not extension

A file's type comes from its content, not its name. A renamed executable is rejected rather than stored as a document, and an archive or executable is refused regardless of what it claims to be.

What is rejected

• Extension spoofing — the signature and the extension disagreeing.
• Archives and executables.
• Empty files.
• Text that is not valid UTF-8, or that contains NUL bytes.
• JSON that does not parse.
• Anything over the size limit.

Filenames are rewritten

Only the basename is kept, and control characters and bidirectional-override characters are stripped from it. Those characters are how a filename is made to display in reverse — the trick that shows a file ending in .txt when it ends in something else — and removing them at storage time means no listing anywhere can be fooled by one.