Your File Upload Endpoint Is Part of Your Attack Surface

Your File Upload Endpoint Is Part of Your Attack Surface Most file upload flows look safe at first glance. You check the extension. You validate the Content-Type header. You set a file size limit. Then you store the file and move on. But that is exactly where many applications stay too optimistic. Real-world upload abuse is not limited to "someone uploaded an .exe". The bigger problem is that modern upload risks often arrive disguised as normal files: ZIP bombs, spoofed MIME types, polyglot files, and documents carrying suspicious embedded behavior. In many systems, the file gets written to disk, pushed to object storage, backed up, indexed, or passed to another service before meaningful inspection ever happens. That is the gap I wanted to solve with Pompelmi. Pompelmi is an open-source file upload scanner for Node.js that runs in-process, with no cloud API and no daemon. The idea is simple: scan untrusted uploads before they touch disk or enter the rest of your pipeli