Attachments: limits and storage

Up to 10 MB per file, from an allow-list of about a dozen safe types — images, PDF, plain text and CSV, Office documents and zip.

Files are stored under uploads/keen2support/ with randomised names behind an .htaccess deny rule, and are only ever served through an authenticated route. Guessing a URL gets you nothing.