Monthly compliance exports for enterprise tenants were routinely crashing the JVM with OOMs on any tenant above ~200k findings. Security teams were forced to schedule off-hours re-runs, and the largest customers simply could not export at all.

Redesigned the export path around a streaming ZIP pipeline: findings are serialized in bounded chunks, framed as ZIP64 entries on the fly, and uploaded to S3 as a multipart stream. Nothing lives fully in heap; back-pressure is bounded by the network, not memory.

Zero OOM incidents post-launch. The largest tenant, previously unable to export at all, now completes in 4 min 18 s. The pattern was extracted into a reusable internal library and adopted by two other services.