Developer staffing guide · 10 minute read ·
Check file-preview isolation before delegating upload QA
Test generated previews, direct URLs, deletion, and tenant boundaries with harmless sample files.
Readiness check
Is the handoff ready?
Use this table before you send the first ticket. Fix the weak spots while access is still limited.
| Area | Ready | Needs work |
|---|---|---|
| Question | One observable file preview isolation decision | A request to inspect everything |
| Fixture | plain sample files assigned to two synthetic tenants in allowed, denied, deleted, and expired states | Customer data or shared credentials |
| Evidence | requesting identity, source owner, preview job, authorization result, and cache response | A pass label without context |
| Approval | Privacy and security owners decide retention, storage, and download policy. | The contractor releases alone |
Name the file preview isolation problem
A preview worker or cached URL exposes a file beyond the account that uploaded it. Turn that concern into one case with an expected result. Name the environment, source revision, and person who will accept or reject the outcome.
Write what may change and what must stay untouched. Privacy and security owners decide retention, storage, and download policy. The programmer can investigate inside that boundary without inheriting a company policy decision.
Build a fixture that can fail safely
Use plain sample files assigned to two synthetic tenants in allowed, denied, deleted, and expired states. Label each starting state and expected outcome before the run. Awkward transitions often explain more than a tidy success case.
Work in an approved test environment. Do not copy production data or use an owner credential. If a case cannot be reproduced safely, record the gap and the access it would require.
Follow the state, not just the screen
Capture requesting identity, source owner, preview job, authorization result, and cache response. Compare the first disagreement across every participating interface, API, worker, data store, or cache.
Use one stated time convention and attach the exact revision. Mark an inference as an inference. A plausible explanation is not a measured result.
Make one defensible change
If the fixture proves a defect, correct the narrowest boundary that explains it. Add a regression case that fails before the patch and passes afterward.
The pull request should describe the old result, new result, commands run, and remaining uncertainty. A standards link can inform the method, but it cannot prove what this application did.
Hand the decision back to its owner
Close with the fixture, observations, patch, test output, exclusions, and next owner. An unresolved product or security decision is a useful finding when it is stated plainly.
The outsourced programmer owns an accurate technical record. The company owns access, customer impact, merge, release, and residual risk.
Copy-ready brief
Paste this into your hiring request
Review one file preview isolation path against written results.
plain sample files assigned to two synthetic tenants in allowed, denied, deleted, and expired states
requesting identity, source owner, preview job, authorization result, and cache response
Privacy and security owners decide retention, storage, and download policy.
Buyer questions
Questions about planning the role
Can this use production data?
Use synthetic records in an approved environment. Escalate any case that requires customer data or a live action.
Who accepts the change?
A named company owner reviews the evidence and retains merge and release authority.
What belongs in the handoff?
Include the revision, fixture, expected and observed results, failed or untested cases, checks, and next owner.
Sources
Planning references
These links explain the security, code review, and worker classification points used in this guide.
- NIST Secure Software Development FrameworkNIST guidance for managing software development risk.
- GitHub pull request reviewsFirst-party documentation for review and approval.
- Google Technical WritingGuidance for instructions another person can follow.