File validation

Drop Upload can restrict which files are accepted and communicate those restrictions to users automatically.

Magic bytes (spoofing detection)

Beyond size, Drop Upload also checks that a file's actual binary content matches what it claims to be — e.g. it rejects a renamed .exe pretending to be image/png. This runs automatically, no prop required, and only covers the most common formats (PNG, JPG, GIF, WEBP, BMP, PDF, ZIP and ZIP-based Office formats, MP4, WEBM, MP3, WAV). A declared type outside that list is never blocked — this is best-effort detection, not exhaustive validation.

These validations happen in the browser to help users pick the right files — they are not a security boundary, since the client can always be manipulated. Always re-validate files on your server.