Not a refactor. Not a rewrite. A rethink. And the security improvement was not something I planned. It was a consequence of thinking about the problem correctly. The Mess That Grew in Silence Our platform handles media for everything. User profile pictures. Maintenance job photos. Lease agreements. Inspection reports. Tenancy documents. Contract files. Management agreements. Entry condition reports. Exit condition reports. Each one slightly different. Some allow multiple files. Some allow only one. Some need a featured image. Some need ordering. Some go to FTP. Some display as a gallery. Some render inline as a PDF. Some generate secure download links. Over ten years, every developer who touched a new media requirement wrote new code for it. Nobody ever stopped to ask whether there was a single thing underneath all these cases. By the time I looked properly, the media handling code scattered across the codebase was over 80,000 lines. But here is the part that troubled me more than the line count.…