[security] M-13: User-controlled filename in file serving API

[jacobyoby]

Severity: Medium
File: files/api.py:40-43

Problem

User-controlled filenames in the file serving API may enable path traversal or content-type confusion.

Remediation

Validate and sanitize filenames. Use safe filename handling patterns.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.

[jacobyoby]

Fixed by #98 (merged): ?extension=/?filename= branches realpath-confined to the upload directory (symlink escapes rejected, legit outcomes unchanged); route CORS now honors 'cross site domains'; serve privileged flag narrowed to admin completing #57. Added file_api_check.py e2e regression check.