Go Preview Security — Applying Watermarks While Keeping Source Assets Immutable

Short answer: create a watermarked derivative for every preview request, keep the source asset identifier immutable, and make the derivative record the only object that a public URL can reach. That rule matters in logistics because a shipment photo is evidence as well as a thumbnail. A dispatcher may need a quick, branded preview in a dashboard, while an auditor later needs the exact camera original. Replacing the source to add a mark saves one write in the short term and creates an expensive i