Version 0.105.2
2026-08-30 08:54:27 UTC
Security
1The endpoint that records a file had no per-account limit, and one request could hold a database connection for thousands of round trips. Both are fixed.
Every other place here that lets a caller create rows is limited per account; the one whose whole job is creating them was limited per address, which bounds a caller rather than an account — a second address was a second allowance. The same request could also name 4,096 parts and insert them one at a time inside a single transaction, so ten such requests, each within every limit the service had, could occupy every database connection at once. Commits are now budgeted per account, generously enough that a full batch of small files passes untouched, and the parts go in as one statement instead of thousands. Making many accounts is still not stopped by this, which is what the human check and the signup limits are for.