Most video transcoding deployments give workers IAM credentials and call multi-tenant security "handled." It isn't. A worker compromised through an FFmpeg CVE or a malicious input has direct access to every tenant's data. The articles and architectures here walk through the strict-broker alternative: workers with zero credentials, presigned URLs with short TTLs, HMAC-signed webhooks, and a security posture that survives a worker exploit without leaking other tenants' bytes. For security architects and engineers running multi-tenant video.