Attachments

Konduit stores attachments in private, secure storage. Every download requires you to be signed in (or to use a valid API key) — there are no public links anyone can open.

Attaching files

Drag-and-drop — drag a file onto the task detail modal
Click the paperclip in the toolbar
Paste — clipboard images work

Multiple files at once is supported. Each file is uploaded individually, with a progress indicator.

Limits

Constraint	Value
Max file size	25 MB per file
Blocked types	`exe`, `bat`, `cmd`, `com`, `msi`, `scr`, `ps1`, `vbs`, `js`, `sh`
Storage allowance	Per workspace plan

The block list applies to extensions, not just MIME types — evil.pdf.exe is rejected.

Downloading

Click any attachment to download. Files are served with hardening headers:

Content-Disposition: attachment — forces download instead of inline render
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; sandbox — blocks script execution if the file is HTML / SVG / JS

This means user-uploaded HTML or SVG can't run scripts in your browser, even if they're crafted to.

Deleting

Hover an attachment → the trash icon. Permanent delete — no recovery once it's gone.

Datatable attachments

DataTables can have attachment-typed columns. Same upload/download model, but the file is stored under the column instead of the task.

Public sharing — not supported

Konduit doesn't support generating public download links for attachments. If you need to share a file externally, download and re-host it. This is a deliberate security choice.

Navigation