My app accepts file uploads (avatars, attachments, imports, whatever it is) and I want tests proving the upload path handles abuse. First, find every upload endpoint or handler in my app and list them with their current limits (if any). Then write tests covering: 1. A file larger than the intended size limit is rejected cleanly, with a proper error to the user, not a crashed request or a hung connection. 2. A file with a disallowed type is rejected. Test both the extension and the actual content where my stack allows content sniffing, because a renamed executable is not an image. 3. Filenames with path traversal attempts (`../../`, absolute paths, null bytes) are sanitized or rejected, and the stored file lands only where it's supposed to. 4. Filenames with Unicode, emoji, and very long names don't break storage or the UI. 5. An upload with no file at all, or a corrupted multipart request, fails gracefully. 6. If uploads are served back to users: stored files can't be used to serve active content (HTML with scripts) under my domain, or they're served with headers that neutralize that. If any of these protections don't exist in my current code, don't silently add them mid-test-writing. Flag each gap, and I'll tell you which to fix. When finished, run the tests and summarize which abuse cases are handled and which are open holes.