The browser uploads straight to Supabase, so the key is caller-controlled — this is what keeps a template row from pointing at another org's object or a patient chart.
The browser uploads straight to Supabase, so the key is caller-controlled — this is what keeps a template row from pointing at another org's object or a patient chart.