#private-files

Drupal private file serving with private:// stream wrapper

Store sensitive uploads outside docroot using private:// and force downloads through Drupal's private file controller so access checks run before bytes are streamed.