What checks belong in a secure image-upload endpoint?

Treat the upload as hostile bytes. Validate the size before buffering when possible, inspect the file signature, decode and re-encode images in a worker, strip metadata, and store them under generated keys.

Control	Why it matters
Magic-byte detection	Rejects renamed executables
Pixel limits	Prevents decompression bombs
Re-encoding	Removes malformed payloads and metadata
Authorization	Connects the asset to an owner
Rate limiting	Controls storage abuse

Serve uploads from a separate media origin with X-Content-Type-Options: nosniff.

<!-- seed-answer:secure-image-uploads-nextjs:0 -->