Security
Boring, predictable, well-behaved security
Files are sensitive. Monkey Upload is built so access rules are enforced in the database and visible in the audit log.
Tenant isolation
Every row carries an account id and is protected by row-level security. Membership and role checks run in the database, not just the UI.
Credential handling
Provider keys and OAuth tokens are stored server-side only, never returned to the browser, and are re-validated before each operation.
Sharing controls
Links can require a password, expire, cap downloads, restrict to a domain, or be revoked instantly. Revocation takes effect immediately.
Auditability
Uploads, moves, deletions, share changes, permission changes and connection events are recorded in an append-only activity log.
Safe previews
Previews are sanitized and never execute active content. Uploaded HTML and scripts are treated as data, not code.
AI least privilege
The Monkey agent runs with the requesting user's permissions. It cannot read a file the user cannot open, and every action is logged.