file-upload-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/file-upload-security/SKILL.md. --> # File Upload Security Validate user uploads: MIME magic bytes, filename sanitization, size limits, separate serving domain, AV scanning, polyglot detection ## ALWAYS - Verify **magic bytes** of every upload server-side. `Content-Type` and file extension are attacker-controlled and never sufficient. Use libmagic, `file-type` (Node), `mimetypes-magic` (Python), or Tika. - Maintain an **allowlist** of accepted types per endpoint (`image/png`, `image/jpeg`, `application/pdf`, …). Deny everything else, including `text/html`, `image/svg+xml` (carries `<script>`), `text/xml`, and `application/octet-stream`. - Sanitize filenames: strip directory components, normalize Unicode, reject `..`, NUL byte, control chars, reserved Windows names (`CON`, `PRN`, `AUX`, `NUL`, `COM1-9`, `LPT1-9`), and any non `[a-zA-Z0-9._-]` characters. Store as a UUID / hash and keep the original filename in a separate, escaped metadata column. - Enforce a **size limit** at the proxy / API gateway *and* at the application — at least double-layer. The proxy limit prevents bandwidth DoS; the app limit prevents memory exhaustion when a proxy is misconfigured. - Store uploads **outside the document root** and serve them from a separate domain (`usercontent.example.net`) on a CDN. Set `Content-Disposition: attachment` for non-image ty