1. Strict 4 MB Limit & Magic-Byte Verification
Jobrov's UploadFileScanner inspects the binary header of every uploaded file (verifying %PDF for PDFs and PK for DOCX archives), enforces a 4 MB cap, and strips embedded scripts or prompt-injection sequences.