FROM THE DOCS

File uploads using the File API are not governed by the permissions on the File type. As such, everyone can upload files to your project. Please reach out in the Forum or Slack if you have any questions about this.

Is it possible to secure file upload capabilities, if so how?

Not out of the box. I have created a file-proxy example that allows you to do encryption, authentication and many other features here: https://github.com/graphcool/templates/tree/master/file-handling/file-proxy

That's extremely helpful thank you!

Look at the

auth-file-proxy

example. It includes a watcher that automatically delete files that are uploaded 'illegally'

Is there any way to turn this off on a project? Since, like you said, "Now it's a Free For All file storage once you know a projectId, with possible billing issues, and some serious legal implications if anyone decides to upload illegal files to your storage."

Yes, you can turn the File API off completely by removing the File Type from your schema (at least with the new CLI)

awesome, thanks!