11/01/2026
An Upload button needs more than a file-extension filter.
If customers attach PDFs, photos, or support documents to your website or mobile app, “we only accept these file types” is a starting point—not the whole security plan.
Five questions to bring to your development team:
• Are allowed file types and size limits checked on the server, not just in the browser?
• Do we validate the file itself instead of trusting its extension or the type reported by the browser?
• Does the app generate a safe storage name rather than use the customer's filename?
• Are uploads stored separately from application code, with permission to run files disabled?
• Is uploaded content scanned for malware before it's made available?
These are layers of protection. No single check makes an upload safe.
At your next development review, ask the team to walk through what happens after someone clicks Upload—including how a rejected file is handled.