Secure Object Storage for Application Files

A common mistake is uploading files to Amazon S3, Cloudflare R2, or Alibaba OSS and making the bucket public. This can expose files that were never meant to be public, particularly when paths are guessable or the data belongs to users.

Keeping a growing file collection on the application server creates a different problem. It consumes disk space and complicates backups, deployments, and migrations. Once the collection reaches tens or hundreds of gigabytes, moving a server or preparing a new environment becomes unnecessarily difficult.

A better approach is a private bucket with access controlled through short-lived signed URLs or a delivery layer such as CloudFront, depending on the file type. Separate file storage from the application, authorize every request, and never treat a file name or path as protection.

Storage is an early architectural and security decision, not a detail to postpone until the product grows.