Files and delivered documents

• Attachments and uploads are size-limited and type-checked, and scanned when antivirus is configured. They are always offered as downloads, never displayed inline.
• Exported documents are self-contained:
  • they carry a strict content-security policy;
  • they never load anything from the network;
  • they refuse to deliver text marked internal.