File validation
Drop Upload can restrict which files are accepted and communicate those restrictions to users automatically.
Magic bytes (spoofing detection)
Beyond size, Drop Upload also checks that a file's actual binary content
matches what it claims to be — e.g. it rejects a renamed .exe pretending
to be image/png. This runs automatically, no prop required, and only
covers the most common formats (PNG, JPG, GIF, WEBP, BMP, PDF, ZIP and
ZIP-based Office formats, MP4, WEBM, MP3, WAV). A declared type outside that
list is never blocked — this is best-effort detection, not exhaustive
validation.
These validations happen in the browser to help users pick the right files — they are not a security boundary, since the client can always be manipulated. Always re-validate files on your server.