Files pass validation… then break in production

Gabriel Maheu — Thu, 30 Apr 2026 16:48:35 +0000

Most upload pipelines check file type and size — and assume the file is safe.

But that’s exactly where things go wrong.

Real issues often show up later — when files are actually used.

The problem isn’t validation.

It’s when validation happens.

The gap

Files are trusted too early.

By the time something breaks, it’s already in production.

I built a Strapi plugin that scans files right after upload, before they’re ever used.

Upload → Scan → Verdict

Right after upload — before anything touches production.

Instead of trusting files based on format, it checks what’s actually inside.

It catches malware, exposed secrets, and unsafe payloads — including issues that pass validation but fail later at runtime.

How are you handling file validation today?

At upload — or only when things break?