An upload acknowledgement only establishes that storage received an object. The object still needs to be checked against the declared size and content type, and decoded as a supported image. Staging separates that untrusted input from the asset the public website will display.
In our implementation, the completion operation has a signed claim bound to the editor, object key, MIME type, size and expiry. It bounds the bytes read, applies a decoder pixel limit, rejects animation, and re-encodes the image to a new WebP key. The source metadata is not carried into the public asset.
Boundaries to review
- Keep staging objects private.
- Validate the stored object, then decode its content.
- Reserve image dimensions in the page layout.
- Keep used assets protected from request-time deletion.
Object storage policy, lifecycle cleanup and CDN exposure are deployment responsibilities. Re-encoding is one boundary in a larger system; it is not a substitute for those controls.