Attachment delete joins a user filename onto the upload path
Your task
Review this helper. The route DELETE /attachments/<filename> calls it with the signed-in user's id and the filename taken from the URL. Each user's files live in their own folder under UPLOAD_ROOT. What do you flag?