Direct answer
Store files as objects owned by a workspace, authorize download on every request, and treat uploads as untrusted. Do not serve user files from the same origin without a content-type you control. MDN’s CSP guidance is part of that: limit what uploaded HTML can do if it is ever sniffed.
The jobs
Upload evidence, download a deliverable, replace a version, expire access when the person leaves. If you cannot expire access, you have a pile of files, not a room.
A practical sequence
Permissions before drag-and-drop.
- Name who may upload vs who may only download
- Scan or at least isolate content types
- Sign download URLs with a short TTL
- Show the filename and size with a text label, not an icon-only control
- Log download events without storing the file in the log
Mistakes that look like progress
Avoid these:
- Emailing the file as well ‘just in case’, forever
- A public bucket with a hard-to-guess URL
- Previewing untrusted PDFs in a privileged origin
What to send if you want a senior review
Share file types, retention, and who must lose access. Related work at Kiwi: SaaS MVP design and development.
Frequently asked questions
Is a branded Dropbox enough?
It can be, if sharing links and offboarding are actually used. Move to a portal room when you need workspace-scoped audit and expiry in your own accounts.
Should files be searchable from Google?
No. Document rooms are authenticated. Keep them out of sitemaps and snippets.
Can we walk through a file room?
Yes, with harmless sample files. Do not use real client documents in a sales demo.
Sources
Figures cited above are drawn from the linked publications and are the responsibility of their sources; we date and scope them rather than presenting them as universal guarantees.