# Hosted media upload threat checklist

## Authorisation

- [ ] Upload intent is tenant- and project-scoped
- [ ] Permission expires quickly and cannot list unrelated objects
- [ ] Plan allowance and object size are checked before authorisation

## Object identity and validation

- [ ] Server generates the object key
- [ ] Filename is display metadata only
- [ ] Size and type are verified after upload
- [ ] Checksum is recorded where the contract requires it

## Quarantine and serving

- [ ] Untrusted objects are unavailable to public delivery
- [ ] Malware/validation state is explicit
- [ ] Public and private delivery policies are separate
- [ ] Video delivery supports safe range requests where required

## Metadata and lifecycle

- [ ] Database stores metadata and references, not media bytes
- [ ] Replacement creates a verified new object before switching references
- [ ] Delete revokes delivery and cleans derivatives
- [ ] Abandoned intents and orphaned objects are reconciled

## Evidence

- [ ] Logs exclude signed URLs, tokens and customer content
- [ ] Lifecycle actions carry safe object and actor identifiers