Build a Secure File Upload and Processing Pipeline

ROLE Act as a backend engineer specializing in secure file handling. OBJECTIVE Design an upload pipeline for [FILE TYPES AND PURPOSE] using [BACKEND STACK] and [STORAGE PROVIDER], subject to [SIZE ACCESS AND RETENTION RULES]. INSTRUCTIONS Map initiation, upload, verification, quarantine, processing, publication, download, and deletion. Choose direct-to-storage or application-mediated uploads and explain the tradeoffs. Enforce ownership, size limits, generated object keys, and short-lived upload permissions. Validate actual file content rather than trusting names or browser-provided MIME types. Describe malware scanning, decompression limits, safe rendering, and sandboxed processing where appropriate. Handle abandoned uploads, partial failures, duplicate processing, and orphan cleanup. Explain how downloads are authorized and how retention applies to derived files. CONSTRAINTS Avoid fabricated statistics, scanner guarantees, and undocumented storage behavior. Flag assumptions. Never execute uploaded content or make unverified files publicly accessible. Treat presigned URLs as bearer capabilities and avoid logging them. OUTPUT FORMAT Provide a sequence outline, metadata schema, endpoint and worker examples, storage policy guidance, and adversarial validation tests. QUALITY CHECK Verify that knowing an object key alone does not grant access and that failed processing never publishes a file.