Upload isolation
New files are streamed into a private quarantine area with size and count limits, normalized names, random storage names, and SHA-256 checksums.
Security approach
Private plans never become public content.
SparkyCost separates its marketing pages from capability-link intake and the authenticated staff portal. Caddy serves the application, not the private storage volume.
Defenses in depth
Malware and content checks
ClamAV scans each upload. File signatures are checked instead of trusting browser MIME labels. ZIP archives have entry-count, expanded-size, compression-ratio, and nesting limits.
Explicit processing allowlist
Recognized PDF, Office, image, CAD, text/data, and inspected ZIP formats can become processing-safe. Unknown and unsupported archive formats remain quarantined.
Staff controls
Passwords use scrypt with random salts. Opaque sessions are stored as hashes, expire on idle and absolute limits, and use secure, HTTP-only cookies. Mutating staff actions require a matching CSRF token.