Audit and harden my app's file upload handling. Find every endpoint that accepts file uploads (avatars, attachments, imports, media). Apply these protections to each: validate the file's actual content (magic bytes or a library that sniffs MIME types) instead of trusting the extension or the client-supplied Content-Type; enforce a maximum file size; generate a random server-side filename instead of using the uploader's original name; store uploads outside the public web root or in object storage so they can never be executed as code; and serve them with a safe Content-Type and Content-Disposition: attachment where appropriate. Do not break existing uploads or change the allowed file types without flagging it to me first. If the app resizes or processes images, make sure the processing library is current and errors on malformed files instead of crashing. Show me each upload endpoint, what it accepted before, and what it accepts now. Give me verification steps: how to attempt uploading an executable file or a file with a fake extension and confirm it's rejected or neutralized.