Upload image or SVG for security audit
Scans for embedded web shells (PHP/ASP), SVG XSS scripts, and polyglot signatures
Ctrl+V to Paste•Max 50MB•100% In-Browser
Application Security: Hardening Image Upload Endpoints
SVG Is XML, Not Pixels
SVG is an XML-based vector format. Browsers naturally execute embedded JavaScript when an SVG is visited directly. Always serve user SVGs with Content-Disposition: attachment or sanitize them using DOMPurify.
Re-encode Uploaded Avatars
The gold standard for avatar security: never serve raw user-uploaded bytes. Decode the image into memory and re-encode it as WebP or JPEG using a library like Sharp. This destroys any trailing web shells or polyglot payloads.
Content Security Policy (CSP)
Host user uploads on a separate, cookie-less subdomain (e.g. media.example.com) with a strict CSP header: script-src 'none'.
Want full AppSec hardening recipes? Read our file upload bypass and defense guide.
Read Upload Guide →