Can we not hardcode this, instead combining `SITE_URL` and the source of `reviewers/apps/review/attachment`?