---
issue: 135
title: "Backend: uploads directory served without authentication — documents guessable by filename"
severity: low
domain: File Management
labels: [security, backend, authorization]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Backend: uploads directory served without authentication — documents guessable by filename

**Severity:** low
**Domain:** File Management
**Labels:** security, backend, authorization

## Description

`backend/src/app.ts:465` serves the `uploads/` directory as static files without any authentication middleware. Anyone who knows or guesses a filename can download it directly. This affects sensitive documents (ID uploads, delivery evidence) as well as public assets (avatars).

Additionally, `fileController.ts:146-148` copies files with verbatim original filenames, which are often predictable (e.g. `passport.jpg`).

## Options

1. Serve sensitive docs through an authenticated route with ownership checks; keep avatars public.
2. Require signed/expiring URLs for all uploads.
3. Move uploads to object storage with access policies.

## Recommendation

Route document downloads through an authenticated, ownership-checked handler (keep public assets like avatars open); consider signed URLs for sensitive files.

## Affected Files

- `backend/src/app.ts:465`
- `backend/src/services/file/fileController.ts:146-148`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-80