Private avatars in a Node.js SaaS: which object storage, and how to sign downloads

Use a private bucket with short-lived presigned URLs when an avatar belongs to exactly one user, and...