They Uploaded a File and It Was Not an Image

Somebody uploaded a profile picture. It was not a picture. The endpoint checked the extension. The file was called avatar.png, and an extension is not a fact. It is a claim, typed by the person uploading. The content type header is the same claim, sent by the same person. So the checks we were proud of amounted to asking a stranger whether the...