Audit all file upload handlers. Check for: missing file type validation (use magic bytes, not just extension), missing file size limits, files stored in public Supabase buckets unintentionally, missing virus/malware scanning, and uploaded files being served from the same origin (enabling XSS).