Security Code Review of File Upload and Processing
Review risks around user-supplied files.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review my file upload feature for security flaws. Accepted file types and purpose: [FILE_TYPES_AND_PURPOSE]. Language, framework, and storage: [STACK_AND_STORAGE]. Upload handler and processing code: [PASTE_CODE]. Use this checklist. For each item answer Pass, Fail, or Cannot tell, quote the relevant line, and give the fix: [ ] Size limits enforced before the full file is read [ ] File type verified by content signature, not only by extension or declared type [ ] Allowed list of types and extensions, not a block list [ ] Filename never used as a path; generated storage names [ ] Files stored outside the web root or in object storage with private access [ ] No execution permission in the upload location [ ] Images re-encoded to remove embedded payloads; documents scanned [ ] Archive handling protected against zip bombs and path traversal [ ] SVG and HTML files sanitized or served with safe headers [ ] Served with a correct content type, a download disposition when needed, and a separate domain for user content [ ] Authorization checks on download and delete [ ] Rate limits and quotas per user [ ] Malware scanning and logging End with the top three exploit scenarios and a prioritized fix list.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Claude, Gemini, ChatGPT or another assistant.