File handling and uploads

Letting users upload files is a quiet minefield, and the AI's first draft almost never closes the holes:

• Validate the type and size. Without limits, someone uploads a 10 GB file or an executable. Check the actual content, not just the filename extension, which anyone can rename.
• Never trust the filename. A filename like ../../etc/passwd can make a naive handler write outside the intended folder (this is called path traversal). Generate your own safe names instead of using the one provided.
• Don't serve uploads from the same origin as your app, and don't let uploaded files be executed as code. A user-supplied file dropped into a folder your server will run is a direct path to takeover.

You don't have to build all this yourself — a storage service handles most of it — but you have to ask, because the AI won't volunteer it. "Add an upload feature" gets you the happy path. "Add an upload feature that validates file type and size, rejects anything but images, and stores files under generated names" gets you something closer to safe.