Attachments
Konduit stores attachments in private, secure storage. Every download requires you to be signed in (or to use a valid API key) — there are no public links anyone can open.
Attaching files
- Drag-and-drop — drag a file onto the task detail modal
- Click the paperclip in the toolbar
- Paste — clipboard images work
Multiple files at once is supported. Each file is uploaded individually, with a progress indicator.
Limits
| Constraint | Value |
|---|---|
| Max file size | Free 5 MB · Pro 25 MB · Business 100 MB per file |
| Blocked types | exe, bat, cmd, com, msi, scr, ps1, vbs, js, sh, svg, html, htm, xhtml, jar, app |
| Storage allowance | Free 50 MB · Pro 5 GB · Business 50 GB per workspace |
The block list applies to extensions, not just MIME types — evil.pdf.exe is rejected.
Downloading
Click any attachment to download. Files are served with hardening headers:
Content-Disposition— conditional: risky, executable, and unknown types are servedattachment(forced download), while images, video, audio, PDF, and plain text are servedinlineso the in-app preview worksX-Content-Type-Options: nosniffContent-Security-Policy: default-src 'none'; sandbox— blocks script execution if the file is HTML / SVG / JS
This means user-uploaded HTML or SVG can't run scripts in your browser, even if they're crafted to.
Deleting
Hover an attachment → the X (Remove) button. Permanent delete — no recovery once it's gone.
Datatable attachments
DataTables can have attachment-typed columns. Same upload/download model, but the file is stored under the column instead of the task.
Public sharing — not supported
Konduit doesn't support generating public download links for attachments. If you need to share a file externally, download and re-host it. This is a deliberate security choice.