Download attachments and whitelist/blacklist strategy

Not sure we’d need to deprecate their name here since we wouldn’t change their behaviour. We could but I don’t think it’s mandatory. Now yes I think we should move them in the security section.