Message details include attachment metadata:
id: the opaque identifier used by the download path.filename: a sanitized display filename, never a storage key.content_type: sender-supplied MIME type after safe parsing.size_bytes: decoded attachment size.expires_at: the same short content deadline.download_path: an authenticated relative API path.
The service validates the authenticated account, parent message, attachment identifier, and expiry before reading private storage. Downloads use application/octet-stream, nosniff, and a forced attachment disposition.
Current hard limits are 10 attachments per message, 5 MiB per attachment, and 8 MiB total decoded attachment data. These safety limits are separate from request allowance.
A sanitized filename and declared content type do not make a file trustworthy.
Scan or quarantine downloads when your risk model requires it.
