Secure a file upload endpoint

Harden a file upload endpoint against all common file upload attack vectors. Server-side: validate the MIME type by reading the file magic bytes, not the Content-Type header or file extension. Scan the file content using an antivirus or malware scanning API before accepting it. Store accepted files in a location outside the web root with no execute permissions. Generate a cryptographically random filename that has no relationship to the original name. Enforce a maximum file size limit. Validate the file path to prevent path traversal. Return no implementation details in error messages.