Function valid_asset_name 

pub fn valid_asset_name(name: &str) -> bool

The one asset filename rule, applied on write and on read.

Exactly ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$, and additionally never containing ... The pattern is this narrow because the name arrives from two untrusted directions and is then joined onto a path: an agent naming the asset, and a URL naming it back to Questions::panel_asset. Every character that could change what the join means is outside the set - / and \ cannot appear, so no name can descend or escape; a leading . is refused, so no name can be .., . or a dotfile; a drive letter’s : is refused, which matters because on Windows Path::join with an absolute path discards the whole prefix and would serve any file on the disk. .. is refused anywhere rather than only at the front so the rule reads the same as the sentence “no traversal” to anyone auditing it.

The length bound keeps a name inside every filesystem’s limit, so a panel that stores cannot fail to store on the operator’s other machine.