Skip to main content
Apply this baseline to every production storage profile and validate it in the customer environment.

​
External storage and identity

  • Use only pre-created customer-owned external buckets or containers.
  • Deny public access and account-wide administration.
  • Use workload identity/default credential chains with the narrowest bucket/container and prefix permissions required by web and worker.
  • Keep administration, preflight attestation, runtime object operations, migration, and retention responsibilities separate where the platform permits.
  • Store secrets in the platform secret manager. Never put them in source, ConfigMaps, images, shell arguments/history, logs, telemetry, support bundles, or certification evidence.
  • Keep TLS verification enabled. Mount private CA files read-only and rotate them with an overlap procedure.
Runtime adapters perform data-plane operations only. They must not create, delete, or configure storage locations.

​
Three purpose profiles

  • quarantine: all user-controlled uploads enter here.
  • records: only scanner-approved user uploads and narrowly defined trusted server-generated exports become available here.
  • ephemeral: deep canaries and short-lived data with a bounded lifecycle.
Use different buckets/containers when policy separation is required. Do not grant end users direct object-store access.

​
Malware scanning fails closed

Production requires external clamd through CLAMD_SOCKET_PATH or CLAMD_HOST. Remote scanner TLS uses CLAMD_TLS=true and CLAMD_CA_FILE; a plaintext private-network exception is an explicit risk exception, not the default. CaseBender calculates SHA-256, writes an upload intent, reads the exact object back, and queues verification. If the scanner is unavailable, times out, returns malformed output, or cannot scan the configured size, the object stays quarantined. Retries are durable; exhaustion becomes a dead letter. Only a terminal CLEAN verdict permits copy to records. An INFECTED result remains quarantined and creates a sensitive security audit event. Never download a live malware sample for troubleshooting.

​
Intentional malware samples

Authorized testing may store a sample with content trust MALWARE_SAMPLE and quarantineOnly. It remains quarantined, is never promoted, and has scan state SKIPPED. Use inert EICAR-equivalent fixtures where possible. Require written authorization, isolated handling, approved retention/destruction, and no support-ticket attachment. Do not weaken scanning policy to make a test pass.

​
Integrity and exact versions

  • Persist application SHA-256, size, provider checksum, and provider version/generation when available.
  • Verify downloaded bytes after upload, promotion, migration, backup, and restore.
  • Treat ETags as opaque; multipart/encrypted ETags may not be MD5.
  • Use conditional create to prevent overwrite races.
  • Address retention, legal hold, restore, and migration by exact object version—not a floating latest object.
  • Alert on storage.checksum_mismatch, missing expected objects, and confirmed orphans.

​
Encryption, WORM, and legal hold

Require TLS and provider-managed server-side encryption. Use customer-managed keys when mandated and verify key rotation/recovery separately. For regulated records, set requireWorm: true and STORAGE_REQUIRE_WORM=true, then qualify provider versioning, object retention/immutability, and legal hold. Readiness fails with category capability when these controls are absent. CaseBender does not bypass governance retention by default, and compliance retention intentionally blocks early deletion. WORM capability in an SDK is not proof that the bucket/container was created with the required immutable settings.

​
No signed URLs

CaseBender storage adapters do not generate presigned S3 URLs, GCS signed URLs, or Azure SAS URLs. Downloads must pass through CaseBender authentication, authorization, tenant checks, lifecycle checks, scanner approval, and audit boundaries.

​
Health

  • /api/health/live is process-only and has no external dependency.
  • /api/health/ready checks configured providers and requires a fresh deep write/read/copy/delete canary on ephemeral.
  • The response exposes only sanitized categories: configuration, authentication, tls, storage, capability, or canary_stale.
Never include endpoint credentials, object keys, bucket names, customer names, or provider exception messages in a public health response.

​
Telemetry and privacy

Monitor aggregated provider, operation, result, latency, byte, scanner, quarantine, outbox, migration, reconciliation, and readiness metrics. Apply least-access controls and retention to observability data. Logs and metric labels may include a canonical provider and operation. They must not include credentials, tokens, signed URLs, connection strings, private keys, file contents, customer object names, or sensitive object keys. Sanitize errors before persistence and support export. See Storage Health and Troubleshooting and Backup and Restore.