Severity: MEDIUM
Location: src/Controllers/FileController.php:222, 294, 369
Bug: Counter ticks every request, not only first download.
Fix: Gate incrementDownloadCount() on !$alreadyDownloaded.
Status: open. Will reply with remediation details when resolved.
Resolved.
All three download paths in src/Controllers/FileController.php (download, playSid, launchEmulator) now gate FileUpload::incrementDownloadCount on the same !$alreadyDownloaded condition that already gated FileDownload::record. A user can no longer inflate a file's public download count by repeatedly hitting /files/download/{id} after their first paid download.
Locking this thread.