Every file is verified and scanned before your form ever sees it
A finished browser upload is not an accepted file. CrossUpload treats the visitor’s “upload complete” message as a hint. A background worker independently reads the stored object, checks its real type from the file signature, streams it through an antivirus scanner and only then marks it ready.
The problem
- Trusting the browser’s declared MIME type lets an HTML page or script masquerade as a PDF.
- Serving files from the same origin as your app invites content-sniffing attacks.
- When a scanner is down, many systems quietly let files through.
How CrossUpload helps
Private quarantine
Bytes go directly from the browser to private object storage using a signed POST policy bound to one key, one content type, a size range and a five-minute expiry.
Real type checks
File signatures are inspected after upload. HTML, SVG and executables are rejected by default, regardless of their extension.
Antivirus scanning
Content is streamed to ClamAV with bounded memory. If scanning is unavailable, the file waits and retries — it is never silently marked clean.
Immutable promotion
The exact verified object version is copied to a new, separate delivery key. Re-using an old upload credential can never change an accepted file.
Safe delivery
Files are served from a separate download origin with nosniff, a sandboxing content-security policy and safe Content-Disposition headers.
Questions
Which file types are supported?
PDF, JPEG, PNG, HEIC/HEIF, WebP, GIF, DOCX, XLSX, TXT and CSV in V1. Projects can narrow the list.
Do you convert or compress files?
No. Files are stored exactly as uploaded. We do not silently convert formats.