Validate file upload handling controls (magic-byte sniffing, randomized storage keys, Content-Disposition: attachment).