Unity WebGL integration with Python Django REST API

[muted horizon]

Implementing Unity WebGL Game Hosting in Django - File Structure and Best Practices

I'm building a platform similar to html5games.com where users can upload Unity WebGL games as zip files. When uploaded, these games need to be automatically extractable and playable in the browser.
My current setup:

Django project with models for Categories and Apps
Custom User model
Unity WebGL games come as zip files containing:

index.html (main game file)
Build folder with .loader.js, .data.gz, .framework.js.gz, and .wasm.gz files

I've started implementing a solution where:

Users upload a zip file via the Apps model
The system extracts the zip to a designated folder
The game becomes playable via a URL like /play/game-slug/

My specific questions:

What's the best way to handle the file extraction process - in the model's save method or in a separate task?
For production, should I serve these extracted files directly through Django or configure Nginx to serve them?
Are there security concerns I should address when extracting and serving user-uploaded game files?
Is iframe the best approach for embedding these games, or are there better alternatives?

[meager pike]

I would do the extraction in a background task. I would serve them via nginx. There are tons of security concerns, primarily with users serving illegal stuff, be it stolen games, malware, CP or other things.

[muted horizon]

yes seems like the main issue is about malware