Flask secure file serving for files stored outside the web root. Use the send_from_directory function to create a secure endpoint, add authorization, prevent directory traversal, and stream files. Force downloads using as_attachment=True and specify a custom attachment_filename.