Audit how my app serves user files: invoices, uploaded documents, exports, reports, attachments. Find every URL pattern that returns a file and check whether access is authorized. For private files, apply one of these: route downloads through an endpoint that loads the file's record, verifies the requester owns it (or has a granted role), and streams the file, or use short-lived signed URLs from my storage provider (S3 presigned URLs or equivalent) generated only after an ownership check. Public assets (marketing images, public avatars) can stay public; the audit must separate the two deliberately. Sequential or predictable file URLs (/files/1001.pdf) must not expose private files even if the filenames look obscure. Do not break legitimate sharing features; if the app has shared links, keep them working but confirm they're unguessable and can be revoked. Do not change where files are stored. Give me an inventory: each file-serving route, public or private, and the protection applied. Then a test: as user A, obtain user B's private file URL and confirm I cannot download it.