File uploads look simple.

A user selects a file, your backend receives it, saves it to storage, and returns a URL.

Done, right?

Not really.

What if someone uploads a malicious file disguised as an image? What if hundreds of users upload large files at the same time? Or what if an infected PDF becomes available for everyone to download?

A simple upload feature can quickly become a security problem.

Let's look at how to build a safer file upload pipeline using S3, magic bytes, and ClamAV .

1. Stop sending files through your API server

A common approach is to receive files through your Node.js backend and then upload them to S3.

This works, but your API becomes a middleman.

Every upload uses server bandwidth and connections.…