Block chameleon files at upload, preview encrypted documents in-browser without ever touching disk.
Attackers rename malicious executables to look like harmless documents. A file called invoice.pdf might actually contain a Windows executable (MZ header). Trusting file extensions or MIME types alone is insufficient.
Our upload pipeline now inspects the first 8 bytes of every file (the "magic bytes" or file signature) to determine the true file type. This catches chameleon files regardless of their extension or declared MIME type.
What’s blocked:
For viewing encrypted documents, the new SecureFilePreview component decrypts files entirely in the browser using openpgp.js and Argon2id. Images render via createObjectURL (memory-only, no disk write), PDFs display in a sandboxed iframe, and all object URLs are revoked on modal close. Content-Security-Policy headers prevent any decrypted content from executing scripts.
Even if a user accidentally uploads a disguised executable, it’s blocked before it reaches storage. And when viewing encrypted documents, the plaintext never leaves browser memory — it cannot be intercepted, cached, or accidentally saved.
Was this update useful?