Attachment downloads should check the record they belong to
Your GET /tickets/:id handler checks that the caller can see the ticket. The files attached to that...
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.