Secure File Upload with Claude Code: S3 Pre-signed URLs and Magic Byte Validation

File upload has more security surface than most features: size limits, MIME type validation, filename sanitization, virus scanning, and storage management. Claude Code generates the full secure upload pipeline. CLAUDE.md for File Upload Standards ## File Upload Rules ### Security (required) - File size limits: images 10MB, documents 25MB, videos 500MB - File type: validate both MIME type AND magic bytes - Filename: replace with random UUID (never use original filename in path) - Virus scanning: ClamAV or AWS S3 Malware Scanning - Storage: S3 only (no local storage in production) ### Allowed file types - Images: image/jpeg, image/png, image/webp, image/gif - Documents: application/pdf - Spreadsheets: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet ### Upload flow 1. Client → API: send metadata → receive pre-signed URL 2. Client → S3: upload directly (bypass server) 3. S3 → API (webhook): upload completion notification 4. API: virus scan → DB registration → issue downlo