All modules
MODULE 06 · IMAGES, VIDEO, PDFS
File storage
Files go in buckets, never in the database.
Uploads look trivial and hide sharp edges: size limits, file types, who can see what. Signed URLs — upload permissions that expire — are the pattern that keeps user files private without your server shuffling bytes.
WHEN YOU NEED IT
Only when users upload things. Plenty of products never do.
THE CHOICE, PER TIER
- T1Supabase Storage with access policies
- T2S3 / GCS with signed URLs
- T3Direct-to-bucket uploads + CDN delivery
SAY THIS TO YOUR AGENT
"Add file upload with a max size and an allowed-type list. Store files in a bucket, keep only the URL in the database, and make private files reachable only through signed URLs."
DONE WHEN
- A 200MB upload fails gracefully with a clear message
- Private files are not reachable by guessing URLs
- Deleting a record cleans up its files