File uploads introduce risks beyond ordinary JSON APIs. Validate file size, content type, file signatures where appropriate, filename handling, storage location, and access permissions.

Never trust a client-provided filename or MIME type as proof of content. Generate server-side object names and store files outside executable application directories.

For large files, direct-to-object-storage uploads using short-lived signed URLs can reduce API-server bandwidth and improve scalability.