diff --git a/app/controllers/attachment.controller.js b/app/controllers/attachment.controller.js
index 7e0695b..17bb7b3 100644
--- a/app/controllers/attachment.controller.js
+++ b/app/controllers/attachment.controller.js
@@ -3,9 +3,12 @@ const { validationResult } = require('express-validator');
 const debug = require('debug');
 
 const Attachment = require('../models/attachment.js');
+const Build = require('../models/build.js');
+const TestExecution = require('../models/execution.js');
 const ManualTestCase = require('../models/manual-test-case.js');
 const SharedStep = require('../models/shared-step.js');
 const attachmentUtils = require('../utils/attachment-utils.js');
+const { describeFile } = require('../utils/multer-config-test-attachments.js');
 const authMiddleware = require('../utils/auth-middleware.js');
 const {
   NotFoundError,
@@ -90,6 +93,61 @@ exports.create = (req, res) => {
     });
 };
 
+/*
+Stores a file an automated test uploaded against a build: a console log, HAR file, video,
+Playwright trace, HTML snapshot or image. The test lists the returned id on the execution
+(or a step) when it saves the execution, and the attachment is linked to it then.
+ */
+exports.createForBuild = (req, res) => {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) {
+    return res.status(422).json({ errors: errors.array() });
+  }
+  if (!req.file) {
+    return res.status(400).send({ message: 'A file is required in the "attachment" field.' });
+  }
+  const { buildId } = req.params;
+
+  return Build.findById(buildId).select('_id team').lean().exec()
+    .then(async (build) => {
+      if (!build) {
+        throw new NotFoundError(`No build found with id ${buildId}`);
+      }
+      if (!authMiddleware.hasTeamAccess(req.user, build.team)) {
+        throw new ForbiddenError('You do not have access to this build');
+      }
+      // multer has already accepted the extension, so this always describes the file.
+      const { kind, mimeType } = describeFile(req.file.originalname);
+      const imageDetails = kind === 'image'
+        ? await attachmentUtils.generateThumbnail(req.file.path) : {};
+
+      const attachment = new Attachment({
+        team: build.team,
+        scope: 'build',
+        build: build._id,
+        kind,
+        filename: req.file.filename,
+        originalName: path.basename(req.file.originalname || ''),
+        mimeType,
+        size: req.file.size,
+        path: req.file.path,
+        ...imageDetails,
+        uploadedBy: req.user ? req.user._id : undefined,
+      });
+      const saved = await attachment.save();
+      log(`Stored ${kind} attachment ${saved._id} for build ${build._id}`);
+      return Attachment.findById(saved._id).select(attachmentUtils.PUBLIC_FIELDS).lean().exec();
+    })
+    .then((saved) => res.status(201).send(saved))
+    .catch(async (err) => {
+      if (req.file) {
+        await attachmentUtils.removeFiles({ path: req.file.path });
+        await attachmentUtils.removeDirectoryIfEmpty(path.dirname(req.file.path));
+      }
+      return handleError(err, res);
+    });
+};
+
 // Express only treats a middleware as an error handler when it declares four parameters,
 // so `next` must stay in the signature even though it is unused - without it multer's
 // rejections (bad mime type, missing owner id) fall through to the default handler and
@@ -97,12 +155,55 @@ exports.create = (req, res) => {
 // eslint-disable-next-line no-unused-vars
 exports.createFail = (error, req, res, next) => res.status(400).send({ error: error.message });
 
+// Resolves the team behind a build-scoped listing: the build itself, or the build an
+// automated execution belongs to.
+const resolveBuildListing = async ({ executionId, buildId }) => {
+  if (executionId) {
+    const execution = await TestExecution.findById(executionId).select('_id build').lean().exec();
+    if (!execution) {
+      throw new NotFoundError(`No execution found with id ${executionId}`);
+    }
+    const build = await Build.findById(execution.build).select('_id team').lean().exec();
+    if (!build) {
+      throw new NotFoundError(`No build found for execution with id ${executionId}`);
+    }
+    return { query: { execution: execution._id, scope: 'build' }, team: build.team };
+  }
+  const build = await Build.findById(buildId).select('_id team').lean().exec();
+  if (!build) {
+    throw new NotFoundError(`No build found with id ${buildId}`);
+  }
+  return { query: { build: build._id, scope: 'build' }, team: build.team };
+};
+
+const findBuildAttachments = (req, res) => {
+  const { executionId, buildId } = req.query;
+  return resolveBuildListing({ executionId, buildId })
+    .then(({ query, team }) => {
+      if (!authMiddleware.hasTeamAccess(req.user, team)) {
+        throw new ForbiddenError('You do not have access to this build');
+      }
+      return Attachment.find(query)
+        .select(attachmentUtils.PUBLIC_FIELDS)
+        .sort('createdAt')
+        .lean()
+        .exec();
+    })
+    .then((attachments) => res.status(200).send({ attachments }))
+    .catch((err) => handleError(err, res));
+};
+
 exports.findAll = (req, res) => {
   const errors = validationResult(req);
   if (!errors.isEmpty()) {
     return res.status(422).json({ errors: errors.array() });
   }
-  const { testCaseId, sharedStepId } = req.query;
+  const {
+    testCaseId, sharedStepId, executionId, buildId,
+  } = req.query;
+  if (executionId || buildId) {
+    return findBuildAttachments(req, res);
+  }
 
   return resolveOwner({ testCaseId, sharedStepId })
     .then(({ field, owner }) => {
@@ -150,7 +251,10 @@ exports.findFile = (req, res) => {
     return res.status(422).json({ errors: errors.array() });
   }
   return findWithAccess(req.params.attachmentId, req.user)
-    .then((attachment) => res.sendFile(path.resolve(attachment.path)))
+    .then((attachment) => res.sendFile(
+      path.resolve(attachment.path),
+      { headers: attachmentUtils.fileHeaders(attachment, req.query.download === 'true') },
+    ))
     .catch((err) => handleError(err, res));
 };
 
@@ -199,6 +303,16 @@ exports.delete = (req, res) => {
         { 'steps.attachments': attachment._id },
         { $pull: { 'steps.$[].attachments': attachment._id } },
       ).exec();
+      if (attachment.scope === 'build') {
+        await TestExecution.updateMany(
+          { attachments: attachment._id },
+          { $pull: { attachments: attachment._id } },
+        ).exec();
+        await TestExecution.updateMany(
+          { 'actions.steps.attachments': attachment._id },
+          { $pull: { 'actions.$[].steps.$[].attachments': attachment._id } },
+        ).exec();
+      }
 
       log(`Deleted attachment ${attachmentId}`);
       return true;
diff --git a/app/controllers/build.controller.js b/app/controllers/build.controller.js
index e8565f5..b0adf95 100644
--- a/app/controllers/build.controller.js
+++ b/app/controllers/build.controller.js
@@ -5,6 +5,7 @@ const debug = require('debug');
 
 const buildMetricsUtils = require('../utils/build-utils.js');
 const imageUtils = require('../utils/image-utils.js');
+const attachmentUtils = require('../utils/attachment-utils.js');
 const validationUtils = require('../utils/validation-utils.js');
 
 const Build = require('../models/build.js');
@@ -103,7 +104,10 @@ exports.create = (req, res) => {
           }
           const testExecutions = executions
             .map((execution) => buildMetricsUtils.buildExecution(execution, savedBuild));
-          return Execution.insertMany(testExecutions)
+          // The build is brand new, so nothing can have been uploaded against it yet; this
+          // drops any attachment ids the executions carry.
+          return attachmentUtils.restrictToBuild(testExecutions, savedBuild._id)
+            .then(() => Execution.insertMany(testExecutions))
             .then((savedExecutions) => buildMetricsUtils
               .addExecutionsToBuild(savedBuild, savedExecutions))
             .catch(async (err) => {
@@ -349,9 +353,12 @@ exports.addExecutions = (req, res) => {
       }
       const testExecutions = executions
         .map((execution) => buildMetricsUtils.buildExecution(execution, existingBuild));
-      return Execution.insertMany(testExecutions)
-        .then((savedExecutions) => buildMetricsUtils
-          .addExecutionsToBuild(existingBuild, savedExecutions))
+      return attachmentUtils.restrictToBuild(testExecutions, existingBuild._id)
+        .then(() => Execution.insertMany(testExecutions))
+        .then(async (savedExecutions) => {
+          await attachmentUtils.linkToExecutions(savedExecutions);
+          return buildMetricsUtils.addExecutionsToBuild(existingBuild, savedExecutions);
+        })
         .catch(async (err) => {
           // Unlike create, the build may already hold executions and screenshots, so only the
           // executions from this failed batch are removed - the caller retries the batch.
@@ -469,6 +476,7 @@ exports.delete = (req, res) => {
       // Cascade the same way deleteMany does: image files on disk first, then the
       // screenshot and execution documents, then the build itself.
       await imageUtils.removeScreenshotDirectories([existingBuild]);
+      await attachmentUtils.removeAttachmentsForBuilds([existingBuild._id]);
       await Screenshot.deleteMany({ build: existingBuild._id }).exec();
       await Execution.deleteMany({ build: existingBuild._id }).exec();
       log(`Deleting build ${buildId} along with ${screenshotIds.length} screenshot(s).`);
@@ -534,6 +542,7 @@ exports.deleteMany = (req, res) => {
       };
       const promises = [
         imageUtils.removeScreenshotDirectories(buildsToDelete),
+        attachmentUtils.removeAttachmentsForBuilds(buildsToDeleteIds),
         // deleteMany rather than the deprecated remove(): remove() is gone in Mongoose 7,
         // where it would silently stop cleaning these up.
         Screenshot.deleteMany({ build: { $in: buildsToDeleteIds } })
diff --git a/app/controllers/execution.controller.js b/app/controllers/execution.controller.js
index 8fb84e7..79036aa 100644
--- a/app/controllers/execution.controller.js
+++ b/app/controllers/execution.controller.js
@@ -3,6 +3,7 @@ const debug = require('debug');
 const TestExecution = require('../models/execution.js');
 const Build = require('../models/build.js');
 const buildMetricsUtils = require('../utils/build-utils.js');
+const attachmentUtils = require('../utils/attachment-utils.js');
 const authMiddleware = require('../utils/auth-middleware.js');
 const { handleError, NotFoundError, ForbiddenError } = require('../exceptions/errors.js');
 
@@ -42,10 +43,12 @@ exports.create = (req, res) => {
         throw new ForbiddenError('You do not have access to this build');
       }
       testExecution = buildMetricsUtils.createExecution(req, buildFound);
-      return testExecution.save();
+      return attachmentUtils.restrictToBuild([testExecution], buildFound._id)
+        .then(() => testExecution.save());
     })
-    .then((savedExecution) => {
+    .then(async (savedExecution) => {
       testExecution = savedExecution;
+      await attachmentUtils.linkToExecutions([testExecution]);
       return buildMetricsUtils.addExecutionToBuild(testExecution.build, testExecution);
     })
     .then((savedBuild) => {
@@ -229,6 +232,7 @@ exports.delete = (req, res) => {
       }
       return TestExecution.findByIdAndRemove(executionId);
     })
+    .then(() => attachmentUtils.removeAttachmentsForExecution(executionId))
     .then(() => res.status(200).send({ message: 'Test execution deleted successfully!' }))
     .catch((err) => handleError(err, res));
 };
diff --git a/app/models/attachment.js b/app/models/attachment.js
index 5434b4f..cc91327 100644
--- a/app/models/attachment.js
+++ b/app/models/attachment.js
@@ -3,8 +3,13 @@ const mongoose = require('mongoose');
 const { Schema } = mongoose;
 
 // What the attachment hangs off. `execution` is accepted now so the upload path does not
-// need reworking when manual runs land; nothing writes it yet.
-const attachmentScopes = ['testcase', 'sharedstep', 'execution'];
+// need reworking when manual runs land; nothing writes it yet. `build` is a file an
+// automated test uploaded while it ran (see below).
+const attachmentScopes = ['testcase', 'sharedstep', 'execution', 'build'];
+
+// What a build-scoped attachment holds, decided server-side from the file extension (see
+// test-attachment-utils). The UI picks a viewer from this, never from the client's mime type.
+const attachmentKinds = ['image', 'log', 'json', 'har', 'video', 'trace', 'archive', 'html'];
 
 // An image a QA attached to a manual test step, referenced from a step's expected result
 // as `![alt](attachment:<id>)` and resolved by the UI to /attachment/:id/file.
@@ -16,6 +21,12 @@ const attachmentScopes = ['testcase', 'sharedstep', 'execution'];
 //
 // An attachment referenced by a frozen ManualTestCaseVersion is never hard-deleted - a
 // historical execution has to render the image the tester actually saw.
+//
+// Automated tests upload attachments too (logs, HAR files, videos, traces, HTML
+// snapshots). Those are scoped to the build, because the execution does not exist yet
+// while the test runs - the same reason screenshots hang off the build. The test then
+// lists the returned ids on the execution (or one of its steps) when it saves it, and
+// `execution` is filled in at that point.
 const AttachmentSchema = mongoose.Schema({
   team: {
     type: Schema.Types.ObjectId,
@@ -43,6 +54,24 @@ const AttachmentSchema = mongoose.Schema({
     ref: 'TestExecution',
     required: false,
   },
+  // Build scope only: the build the file was uploaded against, and the execution that
+  // referenced it once that execution was saved. `execution` stays unset for a file no
+  // execution has claimed (yet).
+  build: {
+    type: Schema.Types.ObjectId,
+    ref: 'Build',
+    required: false,
+  },
+  execution: {
+    type: Schema.Types.ObjectId,
+    ref: 'TestExecution',
+    required: false,
+  },
+  kind: {
+    type: String,
+    enum: attachmentKinds,
+    required: false,
+  },
   // Server-generated. The client's filename is never used to build a path.
   filename: {
     type: String,
@@ -93,6 +122,9 @@ AttachmentSchema.index({ team: 1 }, { unique: false });
 AttachmentSchema.index({ testCase: 1 }, { unique: false });
 AttachmentSchema.index({ sharedStep: 1 }, { unique: false });
 AttachmentSchema.index({ manualExecution: 1 }, { unique: false });
+AttachmentSchema.index({ build: 1 }, { unique: false });
+AttachmentSchema.index({ execution: 1 }, { unique: false });
 
 module.exports = mongoose.model('Attachment', AttachmentSchema);
 module.exports.attachmentScopes = attachmentScopes;
+module.exports.attachmentKinds = attachmentKinds;
diff --git a/app/models/execution.js b/app/models/execution.js
index 229c0eb..60857c3 100644
--- a/app/models/execution.js
+++ b/app/models/execution.js
@@ -37,9 +37,10 @@ const Step = mongoose.Schema({
     ref: 'Screenshot',
     required: false,
   },
-  // Images a QA attached while recording a manual step result. Automated runs use
-  // `screenshot` above; this is the manual equivalent and shares the same subdocument so
-  // there is no parallel step structure to keep in sync.
+  // Images a QA attached while recording a manual step result, or files an automated test
+  // uploaded for this step (e.g. the page's HTML when the step failed). Automated
+  // screenshots still use `screenshot` above; this shares the same subdocument so there is
+  // no parallel step structure to keep in sync.
   attachments: [{
     type: Schema.Types.ObjectId,
     ref: 'Attachment',
@@ -110,6 +111,13 @@ const TestExecutionSchema = mongoose.Schema({
     type: Platform,
     required: false,
   }],
+  // Files the automated test uploaded for the whole execution - a video, a trace, a HAR
+  // file or a console log. Step-level files live on the step (see Step.attachments).
+  attachments: [{
+    type: Schema.Types.ObjectId,
+    ref: 'Attachment',
+    required: false,
+  }],
   tags: [{
     type: String,
     required: false,
diff --git a/app/routes/attachment.routes.js b/app/routes/attachment.routes.js
index aae92eb..62155a6 100644
--- a/app/routes/attachment.routes.js
+++ b/app/routes/attachment.routes.js
@@ -5,6 +5,7 @@ const {
   oneOf,
 } = require('express-validator');
 const multerConfig = require('../utils/multer-config-attachments.js');
+const testAttachmentMulter = require('../utils/multer-config-test-attachments.js');
 const attachmentController = require('../controllers/attachment.controller.js');
 
 module.exports = (app, path) => {
@@ -25,13 +26,30 @@ module.exports = (app, path) => {
     attachmentController.createFail,
   );
 
+  // A file an automated test uploads while it runs: log, HAR, video, trace, HTML snapshot
+  // or image. The build id is in the path so multer has it before writing the file.
+  app.post(
+    `${path}/build/:buildId/attachment`,
+    testAttachmentMulter.single('attachment'),
+    [
+      param('buildId').exists().isMongoId(),
+    ],
+    attachmentController.createForBuild,
+    attachmentController.createFail,
+  );
+
   app.get(`${path}/attachment`, [
     oneOf([
       query('testCaseId').exists().isMongoId(),
       query('sharedStepId').exists().isMongoId(),
-    ], 'A valid testCaseId or sharedStepId is required'),
+      query('executionId').exists().isMongoId(),
+      query('buildId').exists().isMongoId(),
+    ], 'A valid testCaseId, sharedStepId, executionId or buildId is required'),
   ], attachmentController.findAll);
 
+  // `?download=true` serves any attachment as a download instead of inline.
+  // (Build-scoped HTML snapshots, traces and archives are always downloads.)
+
   app.get(`${path}/attachment/:attachmentId`, [
     param('attachmentId').exists().isMongoId(),
   ], attachmentController.findOne);
diff --git a/app/routes/build.routes.js b/app/routes/build.routes.js
index ebeb15a..6af5ab7 100644
--- a/app/routes/build.routes.js
+++ b/app/routes/build.routes.js
@@ -44,6 +44,12 @@ module.exports = (app, path) => {
     check('executions.*.platforms.*.browserVersion').optional().isString(),
     check('executions.*.platforms.*.deviceName').optional().isString(),
     check('executions.*.platforms.*.userAgent').optional().isString(),
+    // Attachments are uploaded against an existing build, so executions posted together
+    // with a new build cannot reference any yet; ids here are validated and then dropped.
+    check('executions.*.attachments').optional().isArray(),
+    check('executions.*.attachments.*').isMongoId(),
+    check('executions.*.actions.*.steps.*.attachments').optional().isArray(),
+    check('executions.*.actions.*.steps.*.attachments.*').isMongoId(),
   ], buildController.create);
 
   app.get(`${path}/build`, [
@@ -172,6 +178,10 @@ module.exports = (app, path) => {
     check('executions.*.platforms.*.browserVersion').optional().isString(),
     check('executions.*.platforms.*.deviceName').optional().isString(),
     check('executions.*.platforms.*.userAgent').optional().isString(),
+    check('executions.*.attachments').optional().isArray(),
+    check('executions.*.attachments.*').isMongoId(),
+    check('executions.*.actions.*.steps.*.attachments').optional().isArray(),
+    check('executions.*.actions.*.steps.*.attachments.*').isMongoId(),
   ], buildController.addExecutions);
 
   app.put(`${path}/build/:buildId/artifacts`, [
diff --git a/app/routes/execution.routes.js b/app/routes/execution.routes.js
index 4e4cd69..a040028 100644
--- a/app/routes/execution.routes.js
+++ b/app/routes/execution.routes.js
@@ -29,6 +29,12 @@ module.exports = (app, path) => {
     check('platforms.*.browserVersion').optional().isString(),
     check('platforms.*.deviceName').optional().isString(),
     check('platforms.*.userAgent').optional().isString(),
+    // Ids returned by POST /build/:buildId/attachment. Ids that were not uploaded against
+    // this execution's build are dropped when the execution is saved.
+    check('attachments').optional().isArray(),
+    check('attachments.*').isMongoId(),
+    check('actions.*.steps.*.attachments').optional().isArray(),
+    check('actions.*.steps.*.attachments.*').isMongoId(),
   ], executionController.create);
 
   app.get(`${path}/execution`, [
diff --git a/app/utils/attachment-utils.js b/app/utils/attachment-utils.js
index 1667324..3f8656c 100644
--- a/app/utils/attachment-utils.js
+++ b/app/utils/attachment-utils.js
@@ -133,4 +133,131 @@ attachmentUtils.removeAttachmentsForOwner = async (scope, ownerId) => {
   return result.deletedCount || 0;
 };
 
+// ── Build-scoped attachments (files uploaded by automated tests) ─────────────
+
+// Kinds that are always downloaded rather than shown inline when opened directly. An HTML
+// snapshot opened inline on the API's origin would run its scripts with the viewer's
+// session cookie; archives have nothing to show inline.
+const DOWNLOAD_ONLY_KINDS = ['html', 'trace', 'archive'];
+
+// Keeps a stored display name safe inside a Content-Disposition header.
+const dispositionFilename = (name) => (name || 'attachment').replace(/[^\w.\- ]+/g, '_');
+
+/*
+Headers for serving an attachment's file.
+
+Every file is served with `nosniff`, so a browser never second-guesses the stored type,
+and with a `sandbox` CSP, so even a file a browser does render (an HTML snapshot opened
+from a link, an SVG inside a zip viewer) runs in an opaque origin with scripts disabled.
+The UI fetches files with XHR and renders HTML in a sandboxed iframe of its own, so none
+of this changes what it shows.
+ */
+attachmentUtils.fileHeaders = (attachment, download) => {
+  const headers = {
+    'X-Content-Type-Options': 'nosniff',
+    'Content-Security-Policy': 'sandbox',
+  };
+  if (attachment.scope !== 'build') {
+    return headers;
+  }
+  headers['Content-Type'] = attachment.mimeType || 'application/octet-stream';
+  const disposition = download || DOWNLOAD_ONLY_KINDS.includes(attachment.kind) ? 'attachment' : 'inline';
+  headers['Content-Disposition'] = `${disposition}; filename="${dispositionFilename(attachment.originalName)}"`;
+  return headers;
+};
+
+// The fields a reader of an execution needs to list and open its attachments. `path` and
+// `filename` are deliberately left out: they are server paths, not something to hand out.
+attachmentUtils.PUBLIC_FIELDS = '_id kind originalName mimeType size execution build createdAt';
+
+const idsOf = (list) => (list || []).map((id) => id.toString());
+
+// Every attachment id an execution references, at execution level and on its steps.
+const referencedIds = (execution) => {
+  const ids = idsOf(execution.attachments);
+  (execution.actions || []).forEach((action) => {
+    (action.steps || []).forEach((step) => ids.push(...idsOf(step.attachments)));
+  });
+  return ids;
+};
+attachmentUtils.referencedIds = referencedIds;
+
+/*
+Drops any attachment id that was not uploaded against the execution's own build.
+
+An execution can only claim files from its own build. Without this a caller could list
+another team's attachment id on their execution and read its name and size back through
+the execution's attachment list (the file itself is still guarded by a team check).
+Unknown ids are dropped rather than rejected, matching how a missing screenshot id on a
+step is tolerated: the test results are worth more than a stale reference.
+
+Updates the (unsaved) execution documents in place.
+ */
+attachmentUtils.restrictToBuild = async (executions, buildId) => {
+  const allIds = [...new Set(executions.flatMap(referencedIds))];
+  if (allIds.length === 0) {
+    return;
+  }
+  const valid = await Attachment.find({ _id: { $in: allIds }, build: buildId, scope: 'build' })
+    .distinct('_id')
+    .exec();
+  const validIds = new Set(valid.map((id) => id.toString()));
+  if (validIds.size < allIds.length) {
+    log(`Dropping ${allIds.length - validIds.size} attachment reference(s) that do not belong to build ${buildId}`);
+  }
+  const keep = (list) => (list || []).filter((id) => validIds.has(id.toString()));
+  executions.forEach((execution) => {
+    execution.set('attachments', keep(execution.attachments));
+    (execution.actions || []).forEach((action) => {
+      (action.steps || []).forEach((step) => {
+        if (step.attachments && step.attachments.length) {
+          step.set('attachments', keep(step.attachments));
+        }
+      });
+    });
+  });
+};
+
+/*
+Records which execution each referenced attachment now belongs to, once the executions
+are saved. This is what lets the attachment list for an execution be a single indexed
+query, and what removes an execution's files when the execution is deleted.
+ */
+attachmentUtils.linkToExecutions = async (executions) => {
+  await Promise.all(executions.map((execution) => {
+    const ids = referencedIds(execution);
+    if (ids.length === 0) {
+      return undefined;
+    }
+    return Attachment.updateMany(
+      { _id: { $in: ids }, build: execution.build, scope: 'build' },
+      { $set: { execution: execution._id } },
+    ).exec();
+  }));
+};
+
+/*
+Removes the build-scoped attachments of the given builds: documents and directories.
+Called wherever builds are deleted, alongside removeScreenshotDirectories.
+ */
+attachmentUtils.removeAttachmentsForBuilds = async (buildIds) => {
+  if (!buildIds || buildIds.length === 0) {
+    return 0;
+  }
+  const result = await Attachment.deleteMany({ build: { $in: buildIds }, scope: 'build' }).exec();
+  await Promise.all(buildIds.map((buildId) => attachmentUtils.removeAttachmentDirectory(buildId)));
+  return result.deletedCount || 0;
+};
+
+/*
+Removes the attachments an execution claimed, files and documents. Files no execution has
+claimed stay with the build and go when the build does.
+ */
+attachmentUtils.removeAttachmentsForExecution = async (executionId) => {
+  const attachments = await Attachment.find({ execution: executionId, scope: 'build' }).lean().exec();
+  await Promise.all(attachments.map((attachment) => attachmentUtils.removeFiles(attachment)));
+  await Attachment.deleteMany({ execution: executionId, scope: 'build' }).exec();
+  return attachments.length;
+};
+
 module.exports = attachmentUtils;
diff --git a/app/utils/build-utils.js b/app/utils/build-utils.js
index 4d08907..790d1a2 100644
--- a/app/utils/build-utils.js
+++ b/app/utils/build-utils.js
@@ -153,7 +153,7 @@ buildMetricsUtils.determineNewState = (existingState, newState) => {
 
 buildMetricsUtils.buildExecution = (executionDetails, build) => {
   const {
-    title, suite, start, end, platforms, tags, meta, actions, feature,
+    title, suite, start, end, platforms, tags, meta, actions, feature, attachments,
   } = executionDetails;
 
   const testExecution = new TestExecution({
@@ -167,6 +167,7 @@ buildMetricsUtils.buildExecution = (executionDetails, build) => {
     tags,
     meta,
     actions,
+    attachments,
     status: buildMetricsUtils.executionStates[0],
   });
   if (actions) {
diff --git a/app/utils/multer-config-test-attachments.js b/app/utils/multer-config-test-attachments.js
new file mode 100644
index 0000000..9be573b
--- /dev/null
+++ b/app/utils/multer-config-test-attachments.js
@@ -0,0 +1,108 @@
+const multer = require('multer');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { ATTACHMENT_ROOT } = require('./multer-config-attachments.js');
+
+// Files an automated test uploads against a build: console logs, HAR files, videos,
+// Playwright traces, HTML snapshots and plain images. Stored beside the manual-testing
+// attachments, grouped by build id so deleting a build is one recursive remove (the same
+// shape as screenshots/<buildId>).
+//
+// The build id comes from the URL (POST /build/:buildId/attachment) rather than a form
+// field, so it is available before multer writes the file regardless of the order the
+// client put the multipart fields in.
+const MONGO_ID_PATTERN = /^[a-f\d]{24}$/i;
+
+// Default 100 MB: a test video or a trace can be tens of megabytes. Configurable because
+// the right ceiling depends on how long a team's tests run and how much disk they have.
+const DEFAULT_MAX_SIZE_MB = 100;
+const configuredMaxSize = Number(process.env.ANGLES_ATTACHMENT_MAX_SIZE_MB);
+const MAX_SIZE_MB = Number.isFinite(configuredMaxSize) && configuredMaxSize > 0
+  ? configuredMaxSize : DEFAULT_MAX_SIZE_MB;
+
+// Everything the server knows about a file comes from this table, keyed by the extension
+// of the client's filename. The client's mime type is ignored: test frameworks report
+// `application/octet-stream` for most of these, and the mime type stored here is what the
+// file is served with later, so it must not be attacker-chosen.
+const TYPES_BY_EXTENSION = {
+  '.png': { kind: 'image', mimeType: 'image/png' },
+  '.jpg': { kind: 'image', mimeType: 'image/jpeg' },
+  '.jpeg': { kind: 'image', mimeType: 'image/jpeg' },
+  '.gif': { kind: 'image', mimeType: 'image/gif' },
+  '.webp': { kind: 'image', mimeType: 'image/webp' },
+  '.log': { kind: 'log', mimeType: 'text/plain' },
+  '.txt': { kind: 'log', mimeType: 'text/plain' },
+  '.json': { kind: 'json', mimeType: 'application/json' },
+  '.har': { kind: 'har', mimeType: 'application/json' },
+  '.webm': { kind: 'video', mimeType: 'video/webm' },
+  '.mp4': { kind: 'video', mimeType: 'video/mp4' },
+  '.zip': { kind: 'archive', mimeType: 'application/zip' },
+  '.html': { kind: 'html', mimeType: 'text/html' },
+  '.htm': { kind: 'html', mimeType: 'text/html' },
+};
+
+/**
+ * Decides how a test attachment is stored and shown, from the client's filename alone.
+ * Returns undefined for an extension that is not supported.
+ *
+ * A zip whose name mentions "trace" is treated as a Playwright trace (Playwright names
+ * them trace.zip); any other zip is a plain archive offered for download.
+ */
+const describeFile = (originalName) => {
+  const base = path.basename(originalName || '').toLowerCase();
+  const extension = path.extname(base);
+  const type = TYPES_BY_EXTENSION[extension];
+  if (!type) {
+    return undefined;
+  }
+  const kind = type.kind === 'archive' && base.includes('trace') ? 'trace' : type.kind;
+  return { ...type, kind, extension: extension === '.jpeg' ? '.jpg' : extension };
+};
+
+const SUPPORTED_EXTENSIONS = Object.keys(TYPES_BY_EXTENSION).join(', ');
+const unsupportedError = () => new Error(`Unsupported attachment type. Supported file extensions: ${SUPPORTED_EXTENSIONS}`);
+
+const multerConfig = multer({
+  limits: { fileSize: MAX_SIZE_MB * 1024 * 1024 },
+  storage: multer.diskStorage({
+    destination(req, file, next) {
+      const { buildId } = req.params;
+      if (!MONGO_ID_PATTERN.test(buildId || '')) {
+        return next(new Error('A valid buildId is required to upload an attachment'));
+      }
+      const directory = path.join(ATTACHMENT_ROOT, buildId);
+      // Defence in depth: even with the pattern above, never write outside the root.
+      if (!directory.startsWith(ATTACHMENT_ROOT + path.sep)) {
+        return next(new Error('A valid buildId is required to upload an attachment'));
+      }
+      if (!fs.existsSync(directory)) {
+        fs.mkdirSync(directory, { recursive: true });
+      }
+      return next(null, directory);
+    },
+    filename(req, file, next) {
+      const description = describeFile(file.originalname);
+      if (!description) {
+        return next(unsupportedError());
+      }
+      // The client's filename is never used to build a path; only the extension it maps
+      // to, which comes from the table above.
+      const unique = crypto.randomBytes(8).toString('hex');
+      return next(null, `${Date.now()}-${unique}${description.extension}`);
+    },
+  }),
+  fileFilter(req, file, next) {
+    if (!file) {
+      return next(null, false);
+    }
+    if (describeFile(file.originalname)) {
+      return next(null, true);
+    }
+    return next(unsupportedError());
+  },
+});
+
+module.exports = multerConfig;
+module.exports.describeFile = describeFile;
+module.exports.MAX_SIZE_MB = MAX_SIZE_MB;
diff --git a/docs/test-attachments.md b/docs/test-attachments.md
new file mode 100644
index 0000000..ef58d26
--- /dev/null
+++ b/docs/test-attachments.md
@@ -0,0 +1,87 @@
+# Test attachments
+
+Automated tests can attach files to their results: console and browser logs, network HAR
+files, video recordings, Playwright traces, page HTML snapshots and images. They are shown
+on the execution in the Angles UI, each with a viewer that suits the file.
+
+## How it works
+
+A test uploads files while it runs, but the execution is only saved when the test
+finishes (or, in batch mode, when the whole run finishes). So, like screenshots, files are
+uploaded against the **build**, and the execution claims them when it is saved:
+
+1. `POST /rest/api/v1.0/build/{buildId}/attachment` with the file in the multipart field
+   `attachment`. The response contains the attachment's `_id` and `kind`.
+2. List the id when saving the execution, either for the whole test or for one step:
+
+   ```json
+   {
+     "title": "Guest user can pay with a saved card",
+     "suite": "Checkout",
+     "build": "<buildId>",
+     "attachments": ["<video id>", "<trace id>", "<har id>"],
+     "actions": [{
+       "name": "Pay with card",
+       "steps": [{
+         "name": "Verify order confirmation",
+         "status": "FAIL",
+         "timestamp": "2026-10-03T09:14:08Z",
+         "attachments": ["<html snapshot id>"]
+       }]
+     }]
+   }
+   ```
+
+   This works for `POST /execution` and for batches sent with
+   `PUT /build/{buildId}/executions`. An id that was not uploaded against the execution's
+   own build is dropped, so an execution can never claim another build's (or team's)
+   file. Executions sent together with a new build (`POST /build`) cannot carry any,
+   because nothing can have been uploaded against a build that does not exist yet.
+
+The Angles clients wrap both steps: upload with `attachFile` (`attach_file` in Python)
+and the id is added to the current test or step for you.
+
+## Supported files
+
+The kind, and the type the file is served with, come from the file extension. The
+client's mime type is ignored, because test frameworks report most of these as
+`application/octet-stream`.
+
+| Extension | Kind | Shown in the UI as |
+|---|---|---|
+| `.log`, `.txt` | `log` | Text, with search |
+| `.json` | `json` | Formatted JSON |
+| `.har` | `har` | A table of requests, with failed requests highlighted |
+| `.webm`, `.mp4` | `video` | A video player |
+| `.zip` with "trace" in the name | `trace` | Download, with a link to the Playwright trace viewer |
+| other `.zip` | `archive` | Download |
+| `.html`, `.htm` | `html` | The page in a sandboxed frame, scripts disabled |
+| `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp` | `image` | The image |
+
+Anything else is rejected with a `400`. The size limit is `ANGLES_ATTACHMENT_MAX_SIZE_MB`
+(default `100`).
+
+## Reading files
+
+- `GET /attachment?executionId=<id>` lists the files an execution claimed (execution- and
+  step-level). `GET /attachment?buildId=<id>` lists everything uploaded against a build.
+  Server paths are never returned.
+- `GET /attachment/{id}/file` serves the file. Range requests work, so videos can be
+  seeked. Add `?download=true` to always download.
+
+Every file is served with `X-Content-Type-Options: nosniff` and
+`Content-Security-Policy: sandbox`, and HTML snapshots, traces and archives are always
+served as downloads. An HTML snapshot is the page under test, so it may contain scripts;
+opened directly from the API it would otherwise run them on the Angles origin with the
+viewer's session.
+
+## Storage and clean-up
+
+Files are written to `attachments/<buildId>/` with server-generated names, on the same
+volume as manual-testing attachments (`/app/attachments` in Docker and Kubernetes).
+
+- Deleting an execution deletes the files it claimed.
+- Deleting a build, by hand or through the nightly clean-up, deletes all of its files,
+  including any that no execution claimed.
+- `DELETE /attachment/{id}` deletes one file and removes it from the execution or step
+  that listed it.
diff --git a/setup/docker-compose.yml b/setup/docker-compose.yml
index 5035f3b..6196996 100644
--- a/setup/docker-compose.yml
+++ b/setup/docker-compose.yml
@@ -36,6 +36,9 @@ services:
       # the settings exist, admins control it from Admin -> Settings and this is
       # ignored, so a restart never reverts their choice.
       - ANGLES_MANUAL_TESTING_ENABLED=${ANGLES_MANUAL_TESTING_ENABLED:-true}
+      # Largest file (in MB) an automated test can attach to a build: logs, HAR files,
+      # videos, traces and HTML snapshots. Stored on the angles_attachments volume.
+      - ANGLES_ATTACHMENT_MAX_SIZE_MB=${ANGLES_ATTACHMENT_MAX_SIZE_MB:-100}
       - MONGO_URL=mongodb://angleshq:%40nglesPassword@mongodb:27017/angles
       # Public origin of this instance. Each SSO provider's redirect/callback URL is
       # derived from it, and must match what is registered with the identity provider,
diff --git a/setup/kubernetes/02-angles-config.yaml b/setup/kubernetes/02-angles-config.yaml
index 0c2dc72..b673be1 100644
--- a/setup/kubernetes/02-angles-config.yaml
+++ b/setup/kubernetes/02-angles-config.yaml
@@ -13,6 +13,9 @@ data:
   # settings document exists, admins control the toggle from Admin -> Settings and
   # this value is ignored, so a restart never reverts their choice.
   ANGLES_MANUAL_TESTING_ENABLED: "true"
+  # Largest file (in MB) an automated test can attach to a build: logs, HAR files,
+  # videos, traces and HTML snapshots. Stored on the attachments volume.
+  ANGLES_ATTACHMENT_MAX_SIZE_MB: "100"
   # change these credentials
   MONGO_ANGLES_USERNAME: "angleshq"
   MONGO_ANGLES_PASSWORD: "Password123"
@@ -81,6 +84,8 @@ data:
       db.screenshots.createIndex({ view: 1 });
       db.attachments.createIndex({ testCase: 1 });
       db.attachments.createIndex({ sharedStep: 1 });
+      db.attachments.createIndex({ build: 1 });
+      db.attachments.createIndex({ execution: 1 });
       db.manualtestruns.createIndex({ team: 1, createdAt: -1 });
       db.builds.createIndex({ team: 1, executionType: 1, start: -1 });
     
diff --git a/setup/mongo-init.js b/setup/mongo-init.js
index 09540bb..3f7ff6e 100644
--- a/setup/mongo-init.js
+++ b/setup/mongo-init.js
@@ -30,5 +30,7 @@ db.screenshots.createIndex({ build: 1 });
 db.screenshots.createIndex({ view: 1 });
 db.attachments.createIndex({ testCase: 1 });
 db.attachments.createIndex({ sharedStep: 1 });
+db.attachments.createIndex({ build: 1 });
+db.attachments.createIndex({ execution: 1 });
 db.manualtestruns.createIndex({ team: 1, createdAt: -1 });
 db.builds.createIndex({ team: 1, executionType: 1, start: -1 });
diff --git a/swagger/swagger.json b/swagger/swagger.json
index 4abd435..99ee976 100644
--- a/swagger/swagger.json
+++ b/swagger/swagger.json
@@ -5872,7 +5872,7 @@
         "tags": [
           "Attachment"
         ],
-        "summary": "List the attachments belonging to a test case or shared step",
+        "summary": "List attachments: of a test case or shared step, or the files an automated execution or build uploaded",
         "parameters": [
           {
             "name": "testCaseId",
@@ -5891,6 +5891,24 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "executionId",
+            "in": "query",
+            "required": false,
+            "description": "List the files an automated execution claimed (execution- and step-level).",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "buildId",
+            "in": "query",
+            "required": false,
+            "description": "List every file uploaded against a build, claimed or not.",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -5915,7 +5933,7 @@
             }
           },
           "404": {
-            "description": "No test case or shared step found with the given id",
+            "description": "No test case, shared step, execution or build found with the given id",
             "content": {
               "application/json": {
                 "schema": {
@@ -6073,12 +6091,12 @@
         "tags": [
           "Attachment"
         ],
-        "summary": "Download the original image",
+        "summary": "Download the attachment's file",
         "responses": {
           "200": {
-            "description": "The image file",
+            "description": "The file",
             "content": {
-              "image/*": {
+              "*/*": {
                 "schema": {
                   "type": "string",
                   "format": "binary"
@@ -6116,7 +6134,19 @@
               }
             }
           }
-        }
+        },
+        "description": "Served with `X-Content-Type-Options: nosniff` and `Content-Security-Policy: sandbox`. Files uploaded by automated tests are served with their stored type; HTML snapshots, traces and archives always as a download (`Content-Disposition: attachment`). Supports range requests, so a video can be seeked.",
+        "parameters": [
+          {
+            "name": "download",
+            "in": "query",
+            "required": false,
+            "description": "`true` to always serve the file as a download.",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ]
       }
     },
     "/attachment/{attachmentId}/thumbnail": {
@@ -7222,6 +7252,98 @@
           }
         }
       }
+    },
+    "/build/{buildId}/attachment": {
+      "parameters": [
+        {
+          "name": "buildId",
+          "in": "path",
+          "required": true,
+          "description": "ID of the build the test is running in.",
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Attachment"
+        ],
+        "summary": "Upload a file from an automated test (log, HAR, video, trace, HTML snapshot or image)",
+        "description": "Multipart upload against the build, made while the test is running (the execution does not exist yet). List the returned id in the execution's `attachments`, or in a step's `attachments`, when saving the execution; it is linked to that execution then. Ids from another build are dropped.\n\nThe kind and served content type are decided from the file extension, never from the client's mime type: `.log`/`.txt` (log), `.json`, `.har`, `.webm`/`.mp4` (video), `.zip` (trace when the name contains \"trace\", otherwise archive), `.html`/`.htm`, and `.png`/`.jpg`/`.jpeg`/`.gif`/`.webp` (image). The size limit is `ANGLES_ATTACHMENT_MAX_SIZE_MB` (default 100).",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "attachment"
+                ],
+                "properties": {
+                  "attachment": {
+                    "type": "string",
+                    "format": "binary",
+                    "description": "The file. Its name's extension decides its kind."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Attachment stored",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TestAttachment"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "No file supplied, an unsupported file type, or a file over the size limit",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DefaultResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "No access to the build's team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DefaultResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No build found with the given id",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DefaultResponse"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Invalid request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ExpressValidatorError"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   "servers": [
@@ -7535,6 +7657,13 @@
           "end": {
             "type": "string",
             "format": "date-time"
+          },
+          "attachments": {
+            "type": "array",
+            "description": "Ids returned by POST /build/{buildId}/attachment. Used by PUT /build/{buildId}/executions; on executions posted together with a new build (POST /build) they are dropped, because nothing can have been uploaded against a build that does not exist yet.",
+            "items": {
+              "type": "string"
+            }
           }
         }
       },
@@ -7658,7 +7787,7 @@
           },
           "attachments": {
             "type": "array",
-            "description": "Images a QA attached while recording a manual step result. Automated runs use `screenshot` instead.",
+            "description": "Images a QA attached while recording a manual step result, or ids returned by POST /build/{buildId}/attachment for files that belong to this step of an automated test (e.g. the page HTML when it failed).",
             "items": {
               "type": "string"
             }
@@ -7813,6 +7942,13 @@
           "executedBy": {
             "type": "string",
             "description": "The user who recorded a manual result."
+          },
+          "attachments": {
+            "type": "array",
+            "description": "Ids returned by POST /build/{buildId}/attachment for files that belong to the whole test, such as a video, trace, HAR file or console log. Ids not uploaded against the execution's build are dropped.",
+            "items": {
+              "type": "string"
+            }
           }
         }
       },
@@ -8992,7 +9128,8 @@
             "enum": [
               "testcase",
               "sharedstep",
-              "execution"
+              "execution",
+              "build"
             ]
           },
           "testCase": {
@@ -9510,6 +9647,52 @@
             "description": "Target folder id, or null to move the cases to the team root."
           }
         }
+      },
+      "TestAttachment": {
+        "description": "A file an automated test uploaded. Server paths are never returned.",
+        "properties": {
+          "_id": {
+            "type": "string",
+            "uniqueItems": true
+          },
+          "kind": {
+            "type": "string",
+            "enum": [
+              "image",
+              "log",
+              "json",
+              "har",
+              "video",
+              "trace",
+              "archive",
+              "html"
+            ],
+            "description": "Decided from the file extension."
+          },
+          "originalName": {
+            "type": "string",
+            "description": "The uploaded filename, for display only."
+          },
+          "mimeType": {
+            "type": "string",
+            "description": "The type the file is served with, decided from its extension."
+          },
+          "size": {
+            "type": "number",
+            "description": "Bytes."
+          },
+          "build": {
+            "type": "string"
+          },
+          "execution": {
+            "type": "string",
+            "description": "The execution that listed this attachment when it was saved. Absent until then."
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
       }
     }
   }
diff --git a/test/test-attachment.tests.js b/test/test-attachment.tests.js
new file mode 100644
index 0000000..e1e4bb1
--- /dev/null
+++ b/test/test-attachment.tests.js
@@ -0,0 +1,425 @@
+/**
+ * Tests for attachments uploaded by automated tests: logs, HAR files, videos, traces,
+ * HTML snapshots and images.
+ *
+ * They are uploaded against the build (the execution does not exist yet while the test
+ * runs) and claimed by an execution, or one of its steps, when the execution is saved.
+ * The load-bearing rules are that an execution can only claim files from its own build,
+ * that files are served in a way a browser will not execute, and that they go away with
+ * the execution or build they belong to.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const request = require('supertest');
+const should = require('should');
+const bcrypt = require('bcryptjs');
+const app = require('../server.js');
+const User = require('../app/models/user.js');
+const Build = require('../app/models/build.js');
+const Environment = require('../app/models/environment.js');
+const TestExecution = require('../app/models/execution.js');
+const Attachment = require('../app/models/attachment.js');
+const { Team } = require('../app/models/team.js');
+const buildUtils = require('../app/utils/build-utils.js');
+const attachmentUtils = require('../app/utils/attachment-utils.js');
+
+const baseUrl = '/rest/api/v1.0/';
+const IMAGE = './test/resources/angles_home_page.jpg';
+
+const MEMBER_PASSWORD = 'unit-testing-TaMember1!';
+const LEAD_PASSWORD = 'unit-testing-TaLead1!';
+const OUTSIDER_PASSWORD = 'unit-testing-TaOutsider1!';
+
+describe('Test attachment API Tests', () => {
+  let memberAgent;
+  let leadAgent;
+  let outsiderAgent;
+  let team;
+  let otherTeam;
+  let environment;
+  let build;
+  let otherBuild;
+  let fixtureDir;
+  const files = {};
+
+  const login = (username, password) => new Promise((resolve, reject) => {
+    const agent = request.agent(app);
+    agent
+      .post(`${baseUrl}auth/login`)
+      .send({ username, password })
+      .end((err, res) => {
+        if (err) return reject(err);
+        if (res.status !== 200) return reject(new Error(`login failed for ${username}: ${res.status}`));
+        return resolve(agent);
+      });
+  });
+
+  const send = (agent, method, url, body) => new Promise((resolve, reject) => {
+    const req = agent[method](`${baseUrl}${url}`).set('Accept', 'application/json');
+    if (body !== undefined) req.send(body);
+    req.end((err, res) => (err ? reject(err) : resolve(res)));
+  });
+
+  const upload = (agent, buildId, file, contentType) => new Promise((resolve, reject) => {
+    const req = agent.post(`${baseUrl}build/${buildId}/attachment`);
+    if (file) req.attach('attachment', file, contentType ? { contentType } : undefined);
+    req.end((err, res) => (err ? reject(err) : resolve(res)));
+  });
+
+  const download = (agent, url) => new Promise((resolve, reject) => {
+    agent.get(`${baseUrl}${url}`)
+      .buffer(true)
+      .parse((res, callback) => {
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => callback(null, Buffer.concat(chunks)));
+      })
+      .end((err, res) => (err ? reject(err) : resolve(res)));
+  });
+
+  const newBuild = (owner, name) => new Build({
+    name,
+    team: owner,
+    environment,
+    status: buildUtils.executionStates[0],
+    component: owner.components[0]._id,
+    suites: [],
+    result: new Map(buildUtils.defaultResultMap),
+  }).save();
+
+  const removeFixtures = async () => {
+    const teams = await Team.find({ name: /^unit-testing-ta-/ }).select('_id').lean();
+    const teamIds = teams.map((t) => t._id);
+    const builds = await Build.find({ team: { $in: teamIds } }).select('_id').lean();
+    const buildIds = builds.map((b) => b._id.toString());
+    await attachmentUtils.removeAttachmentsForBuilds(buildIds);
+    await Promise.all([
+      TestExecution.deleteMany({ build: { $in: buildIds } }).exec(),
+      Build.deleteMany({ _id: { $in: buildIds } }).exec(),
+      Environment.deleteMany({ name: /^unit-testing-ta-/ }).exec(),
+      User.deleteMany({ username: /^unit-testing-ta-/ }).exec(),
+      Team.deleteMany({ _id: { $in: teamIds } }).exec(),
+    ]);
+  };
+
+  before(async () => {
+    await removeFixtures();
+
+    team = await new Team({ name: 'unit-testing-ta-team', components: [{ name: 'ta-component' }] }).save();
+    otherTeam = await new Team({ name: 'unit-testing-ta-other', components: [{ name: 'ta-other' }] }).save();
+    environment = await new Environment({ name: 'unit-testing-ta-env' }).save();
+    build = await newBuild(team, 'unit-testing-ta-build');
+    otherBuild = await newBuild(otherTeam, 'unit-testing-ta-other-build');
+
+    const [memberHash, leadHash, outsiderHash] = await Promise.all([
+      bcrypt.hash(MEMBER_PASSWORD, 10),
+      bcrypt.hash(LEAD_PASSWORD, 10),
+      bcrypt.hash(OUTSIDER_PASSWORD, 10),
+    ]);
+    await User.create([
+      {
+        username: 'unit-testing-ta-member', password: memberHash, role: 'user', teams: [team._id],
+      },
+      {
+        username: 'unit-testing-ta-lead', password: leadHash, role: 'team_lead', teams: [team._id],
+      },
+      {
+        username: 'unit-testing-ta-outsider', password: outsiderHash, role: 'user', teams: [otherTeam._id],
+      },
+    ]);
+    [memberAgent, leadAgent, outsiderAgent] = await Promise.all([
+      login('unit-testing-ta-member', MEMBER_PASSWORD),
+      login('unit-testing-ta-lead', LEAD_PASSWORD),
+      login('unit-testing-ta-outsider', OUTSIDER_PASSWORD),
+    ]);
+
+    fixtureDir = fs.mkdtempSync(path.join(os.tmpdir(), 'angles-ta-'));
+    const write = (name, contents) => {
+      const file = path.join(fixtureDir, name);
+      fs.writeFileSync(file, contents);
+      return file;
+    };
+    files.log = write('console.log', 'INFO page loaded\nERROR TypeError: x is undefined\n');
+    files.har = write('network.har', JSON.stringify({ log: { version: '1.2', entries: [] } }));
+    files.video = write('video.webm', Buffer.from([0x1a, 0x45, 0xdf, 0xa3]));
+    files.trace = write('trace.zip', Buffer.from('PK\u0003\u0004'));
+    files.zip = write('screenshots.zip', Buffer.from('PK\u0003\u0004'));
+    files.html = write('page.html', '<html><body><script>alert(1)</script></body></html>');
+    files.exe = write('payload.exe', 'MZ');
+  });
+
+  after(async () => {
+    await removeFixtures();
+    fs.rmSync(fixtureDir, { recursive: true, force: true });
+  });
+
+  describe('POST /build/:buildId/attachment', () => {
+    it('stores each supported file with a kind decided from its extension', async () => {
+      const expectations = [
+        [files.log, 'log', 'text/plain'],
+        [files.har, 'har', 'application/json'],
+        [files.video, 'video', 'video/webm'],
+        [files.trace, 'trace', 'application/zip'],
+        [files.zip, 'archive', 'application/zip'],
+        [files.html, 'html', 'text/html'],
+        [IMAGE, 'image', 'image/jpeg'],
+      ];
+      // eslint-disable-next-line no-restricted-syntax
+      for (const [file, kind, mimeType] of expectations) {
+        // Test frameworks usually send octet-stream; the stored type must not depend on it.
+        // eslint-disable-next-line no-await-in-loop
+        const res = await upload(memberAgent, build._id, file, 'application/octet-stream');
+        should(res.status).equal(201, `${path.basename(file)}: ${JSON.stringify(res.body)}`);
+        should(res.body.kind).equal(kind);
+        should(res.body.mimeType).equal(mimeType);
+        should(res.body.originalName).equal(path.basename(file));
+        should(res.body.build).equal(build._id.toString());
+        should(res.body.size).be.above(0);
+        files[`${kind}Id`] = res.body._id;
+      }
+    });
+
+    it('does not return server paths', async () => {
+      const res = await upload(memberAgent, build._id, files.log);
+      should(res.status).equal(201);
+      should(res.body).not.have.property('path');
+      should(res.body).not.have.property('filename');
+      should(res.body).not.have.property('thumbnail');
+    });
+
+    it('writes the file under the build with a generated name', async () => {
+      const stored = await Attachment.findById(files.logId).lean();
+      should(stored.scope).equal('build');
+      should(stored.path).match(new RegExp(`attachments/${build._id}/`));
+      should(stored.path).not.match(/console/);
+      should(fs.existsSync(stored.path)).equal(true);
+    });
+
+    it('generates a thumbnail for an image only', async () => {
+      const image = await Attachment.findById(files.imageId).lean();
+      should(image.thumbnail).be.a.String();
+      should(fs.existsSync(image.thumbnail)).equal(true);
+      const log = await Attachment.findById(files.logId).lean();
+      should(log.thumbnail).equal(undefined);
+    });
+
+    it('rejects an unsupported file type with a 400', async () => {
+      const res = await upload(memberAgent, build._id, files.exe);
+      should(res.status).equal(400);
+      should(res.body.error).match(/Unsupported attachment type/);
+    });
+
+    it('rejects a request without a file with a 400', async () => {
+      const res = await upload(memberAgent, build._id);
+      should(res.status).equal(400);
+    });
+
+    it('returns 404 for an unknown build and leaves no file behind', async () => {
+      const missing = '0123456789abcdef01234567';
+      const res = await upload(memberAgent, missing, files.log);
+      should(res.status).equal(404);
+      should(fs.existsSync(path.join(attachmentUtils.ATTACHMENT_ROOT, missing))).equal(false);
+    });
+
+    it('returns 403 when uploading to another team\'s build', async () => {
+      const res = await upload(outsiderAgent, build._id, files.log);
+      should(res.status).equal(403);
+    });
+  });
+
+  describe('Claiming attachments from an execution', () => {
+    let execution;
+    let foreignId;
+
+    before(async () => {
+      const foreign = await upload(outsiderAgent, otherBuild._id, files.log);
+      should(foreign.status).equal(201);
+      foreignId = foreign.body._id;
+    });
+
+    it('links execution and step attachments when the execution is saved', async () => {
+      const res = await send(memberAgent, 'post', 'execution', {
+        title: 'unit-testing-ta checkout',
+        suite: 'unit-testing-ta suite',
+        build: build._id.toString(),
+        attachments: [files.videoId, files.traceId, files.harId],
+        actions: [{
+          name: 'Pay',
+          steps: [{
+            name: 'Verify confirmation',
+            status: 'FAIL',
+            timestamp: new Date(),
+            attachments: [files.htmlId],
+          }],
+        }],
+      });
+      should(res.status).equal(201);
+      execution = res.body;
+      should(execution.attachments).eql([files.videoId, files.traceId, files.harId]);
+      should(execution.actions[0].steps[0].attachments).eql([files.htmlId]);
+
+      const linked = await Attachment.find({ execution: execution._id }).select('_id').lean();
+      should(linked.map((a) => a._id.toString()).sort())
+        .eql([files.videoId, files.traceId, files.harId, files.htmlId].sort());
+    });
+
+    it('drops ids that were not uploaded against the same build', async () => {
+      const res = await send(memberAgent, 'post', 'execution', {
+        title: 'unit-testing-ta foreign',
+        suite: 'unit-testing-ta suite',
+        build: build._id.toString(),
+        attachments: [foreignId, files.logId],
+      });
+      should(res.status).equal(201);
+      should(res.body.attachments).eql([files.logId]);
+      const foreign = await Attachment.findById(foreignId).lean();
+      should(foreign.execution).equal(undefined);
+    });
+
+    it('rejects malformed attachment ids with a 422', async () => {
+      const res = await send(memberAgent, 'post', 'execution', {
+        title: 'unit-testing-ta malformed',
+        suite: 'unit-testing-ta suite',
+        build: build._id.toString(),
+        attachments: ['not-an-id'],
+      });
+      should(res.status).equal(422);
+    });
+
+    it('links attachments for executions added in a batch', async () => {
+      const log = await upload(memberAgent, build._id, files.log);
+      const res = await send(memberAgent, 'put', `build/${build._id}/executions`, {
+        executions: [{
+          title: 'unit-testing-ta batched',
+          suite: 'unit-testing-ta suite',
+          attachments: [log.body._id],
+        }],
+      });
+      should(res.status).equal(200);
+      const stored = await Attachment.findById(log.body._id).lean();
+      should(stored.execution).not.equal(undefined);
+      const batched = await TestExecution.findById(stored.execution).lean();
+      should(batched.title).equal('unit-testing-ta batched');
+    });
+
+    it('drops attachment ids on executions posted with a new build', async () => {
+      const res = await send(memberAgent, 'post', 'build', {
+        environment: 'unit-testing-ta-env',
+        team: 'unit-testing-ta-team',
+        component: 'ta-component',
+        name: 'unit-testing-ta-new-build',
+        start: new Date(),
+        executions: [{
+          title: 'unit-testing-ta new',
+          suite: 'unit-testing-ta suite',
+          attachments: [files.logId],
+        }],
+      });
+      should(res.status).equal(201);
+      const created = res.body.suites[0].executions[0];
+      should(created.attachments).eql([]);
+    });
+
+    describe('GET /attachment?executionId=', () => {
+      it('lists the attachments an execution claimed, without server paths', async () => {
+        const res = await send(memberAgent, 'get', `attachment?executionId=${execution._id}`);
+        should(res.status).equal(200);
+        const ids = res.body.attachments.map((a) => a._id).sort();
+        should(ids).eql([files.videoId, files.traceId, files.harId, files.htmlId].sort());
+        res.body.attachments.forEach((attachment) => {
+          should(attachment).not.have.property('path');
+          should(attachment.kind).be.a.String();
+        });
+      });
+
+      it('lists every attachment uploaded against a build', async () => {
+        const res = await send(memberAgent, 'get', `attachment?buildId=${build._id}`);
+        should(res.status).equal(200);
+        should(res.body.attachments.length).be.above(6);
+      });
+
+      it('returns 403 to another team', async () => {
+        const res = await send(outsiderAgent, 'get', `attachment?executionId=${execution._id}`);
+        should(res.status).equal(403);
+      });
+    });
+
+    describe('GET /attachment/:id/file', () => {
+      it('serves a log inline with its stored type and safe headers', async () => {
+        const res = await download(memberAgent, `attachment/${files.logId}/file`);
+        should(res.status).equal(200);
+        should(res.headers['content-type']).match(/^text\/plain/);
+        should(res.headers['x-content-type-options']).equal('nosniff');
+        should(res.headers['content-security-policy']).equal('sandbox');
+        should(res.headers['content-disposition']).match(/^inline; filename="console.log"/);
+        should(res.body.toString()).match(/TypeError/);
+      });
+
+      it('always serves an HTML snapshot as a download', async () => {
+        const res = await download(memberAgent, `attachment/${files.htmlId}/file`);
+        should(res.status).equal(200);
+        should(res.headers['content-disposition']).match(/^attachment; filename="page.html"/);
+        should(res.headers['content-security-policy']).equal('sandbox');
+      });
+
+      it('serves any attachment as a download when asked', async () => {
+        const res = await download(memberAgent, `attachment/${files.videoId}/file?download=true`);
+        should(res.status).equal(200);
+        should(res.headers['content-type']).equal('video/webm');
+        should(res.headers['content-disposition']).match(/^attachment;/);
+      });
+
+      it('supports range requests, so a video can be seeked', async () => {
+        const res = await new Promise((resolve, reject) => {
+          memberAgent.get(`${baseUrl}attachment/${files.videoId}/file`)
+            .set('Range', 'bytes=0-1')
+            .end((err, response) => (err ? reject(err) : resolve(response)));
+        });
+        should(res.status).equal(206);
+      });
+
+      it('returns 403 to another team', async () => {
+        const res = await download(outsiderAgent, `attachment/${files.logId}/file`);
+        should(res.status).equal(403);
+      });
+    });
+
+    describe('DELETE /attachment/:id', () => {
+      it('removes the reference from the execution and its steps', async () => {
+        let res = await send(memberAgent, 'delete', `attachment/${files.harId}`);
+        should(res.status).equal(200);
+        res = await send(memberAgent, 'delete', `attachment/${files.htmlId}`);
+        should(res.status).equal(200);
+        const stored = await TestExecution.findById(execution._id).lean();
+        should(stored.attachments.map(String)).eql([files.videoId, files.traceId]);
+        should(stored.actions[0].steps[0].attachments).eql([]);
+      });
+    });
+
+    describe('DELETE /execution/:id', () => {
+      it('removes the attachments the execution claimed, files included', async () => {
+        const video = await Attachment.findById(files.videoId).lean();
+        const res = await send(leadAgent, 'delete', `execution/${execution._id}`);
+        should(res.status).equal(200);
+        should(await Attachment.countDocuments({ execution: execution._id })).equal(0);
+        should(fs.existsSync(video.path)).equal(false);
+      });
+    });
+  });
+
+  describe('DELETE /build/:id', () => {
+    it('removes the build\'s attachments and their directory', async () => {
+      const disposable = await newBuild(team, 'unit-testing-ta-disposable');
+      const res = await upload(memberAgent, disposable._id, files.log);
+      should(res.status).equal(201);
+      const directory = path.join(attachmentUtils.ATTACHMENT_ROOT, disposable._id.toString());
+      should(fs.existsSync(directory)).equal(true);
+
+      const deleted = await send(leadAgent, 'delete', `build/${disposable._id}`);
+      should(deleted.status).equal(200);
+      should(await Attachment.countDocuments({ build: disposable._id })).equal(0);
+      should(fs.existsSync(directory)).equal(false);
+    });
+  });
+});