[off topic] I apologise in advance for the unsolicited review - I couldn't help it. First, in service.api.api:43-49 you do: filename = (file.filename if f

[off topic] I apologise in advance for the unsolicited review - I couldn't help it. First, in service.api.api:43-49 you do: filename = (file.filename if file else None) or request.form.get("filename") [...] try: stored_metadata = storage.store(filename, file) My understanding is you're receiving some file then storing it somewhere with the name provided by the client. That to me looks like a potential security issue. It looks like this function (what is this, Flask?) is both a view and a validator, yet it looks like the file name is not sanitised in any way. I would not accept all characters here. There are two problems: first is the name you use to save the file on disk. Think about e.g. slashes, dots, spaces and the non-printable characters. The other one is about access: if e.g. the file name contains "#" or other special URL character, the file might not be accessible at all. Second, in service.api.api:54-55 you have: except storage.FileTooBigException as e: raise FileTooBig(str(e)) This masks the original exception. In order to avoid that, you have to tell the engine the new exception you're raising is the direct cause of some other exception: except storage.FileTooBigException as e: raise FileTooBig(str(e)) from e It might not be that important with a client error like this, though. At worst it helps with debugging. [/off topic]