I built a private file upload scanner for Node.js

Most apps treat file uploads like a boring feature. A user picks a file, the backend saves it, and everyone moves on. But uploads are part of your attack surface. That’s why I built pompelmi : an open-source file upload scanner for Node.js that scans files before they touch disk , runs in-process , and keeps everything local . GitHub • Docs Why I made it A lot of upload pipelines still rely on very weak checks: file extension user-provided MIME type maybe a size limit maybe a scan later in the pipeline The problem is simple: by the time many systems inspect the file properly, it may already be saved, forwarded, or stored somewhere else. I wanted the opposite approach. I wanted scanning to happen early . Not in some remote API. Not in a separate daemon. Not after the risky part. Right where the upload enters the app. What pompelmi is pompelmi is a privacy-first file upload scanner for Node.js. It is designed for developers who want a cleaner default: scan locally block early keep file b