Keep buckets private
Store files in private buckets and rely on signed URLs for access instead of public objects.
Validate on the client
Enforce file size and type limits in your UI to prevent accidental or malicious uploads.
Formbase does not inspect file contents or enforce MIME types. If you need strict controls, validate before forwarding uploads.