Ah yes, I already generate a policy so only signed in users can upload files to our S3 buckets. And files that aren't attached to a saved database entry (e.g. a comment) are automatically pruned.

So I think things are pretty safe as is. Just wondering if there are any best practices otherwise.