The vendor's upload endpoint does not enforce token-to-location scope — the file lands wherever the token belongs, regardless of the location claimed. Since the returned URLs embed the real location as the first path segment, the code verifies it, and on mismatch deletes the file at the location it actually landed in and returns null so the caller falls back to org-scoped storage.
Also called: cross-tenant upload · photo in another company's library · SEV-1 media guard
- 1Upload completes and returns a filesafe CDN URL.
- 2The URL is checked for the expected location segment.
- 3On mismatch the incident is logged with both locations.
- 4The delete is addressed to the host location parsed from the URL — a delete addressed to the claimed location would 401 against that same token.
- 5null is returned so the caller stores the file elsewhere.
This is the second half of the 07-30 SEV-1: 'upload-file does NOT enforce token↔location scope: the file lands in the TOKEN's location no matter what ctx.loc claims. A wrong-identity token therefore hosts one tenant's image inside another tenant's media library (how a Graber screenshot surfaced in Barnhouse's).'
- A mis-scoped token could host one builder's images inside another builder's media library.
- A naive delete would fail because it was addressed to the wrong location.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →