Filestack

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the upload and file handling I actually need instead of Filestack.

One rule shapes the whole design: **files never pass through your application server.** Presign, upload direct to storage, verify afterwards.

STACK
- Node 20+ with Fastify, for signing and bookkeeping only
- SQLite through better-sqlite3, WAL mode
- Object storage with presigned multipart uploads
- Uppy in the browser, which also gives you the cloud-drive picker
- sharp and ffmpeg on a worker, ClamAV for scanning
- Caddy in front

THE DATA MODEL
- uploads: id, owner_id, key, filename, declared_type, detected_type, bytes, sha256, status, created_at
- derivatives: id, upload_id, kind, key, bytes
- scans: id, upload_id, verdict, detail, at
- access_grants: id, upload_id, subject, expires_at

THE PICKER, WHICH IS THE HALF WORTH TAKING FROM SOMEBODY ELSE
- Uppy with Companion gives you Drive, Dropbox, OneDrive, a URL importer and a camera, all open source. **Do not implement OAuth against five cloud providers yourself** — it is weeks of work and permanent maintenance
- Companion runs as a small service and streams the remote file straight to your storage without touching the browser

THE UPLOAD
- Presigned multipart with a size cap, a type constraint and a short expiry
- Chunks uploaded during selection, resumable after a dropped connection
- **Verify server-side that the object exists and its size matches before marking it complete.** Never trust the client saying it finished

SAFETY, WHICH IS THE ACTUAL WORK
- **Detect the type from the bytes, not the extension and not the declared content type.** A file that claims to be a PNG and is HTML, served from your own domain, is stored cross-site scripting
- Serve user files from a separate domain, with `Content-Disposition: attachment` by default and a strict content security policy on that domain
- Scan with ClamAV before the file is reachable; quarantine until it passes
- Hard caps on size, dimensions and megapixels. Decompression bombs are real
- Strip metadata from images by default — **holiday photographs carry GPS coordinates**, and republishing them is a privacy incident you caused

DERIVATIVES AND DELIVERY
- Thumbnails, poster frames and PDF first pages on a queue with a concurrency cap
- Deduplicate by hash: the same file twice is one object
- Signed expiring URLs for anything private; a cheap network in front of anything public
- Range requests supported so media seeking works

HOUSEKEEPING
- A sweeper deleting pending uploads that never completed
- Per-owner quotas, and bytes stored and served recorded daily
- Deletion that reaches the object, its derivatives and every row

WHAT MATTERS MOST
Type detection from the bytes, a separate serving domain, and metadata stripping. Those three are the difference between a file service and a vulnerability.