#12 store files in a per-case folder and do security checks