{"action":"opened","issue":{"url":"https://api.github.com/repos/CulturalMe/meteor-slingshot/issues/119","labels_url":"https://api.github.com/repos/CulturalMe/meteor-slingshot/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/CulturalMe/meteor-slingshot/issues/119/comments","events_url":"https://api.github.com/repos/CulturalMe/meteor-slingshot/issues/119/events","html_url":"https://github.com/CulturalMe/meteor-slingshot/issues/119","id":95008375,"number":119,"title":"Question about security","user":{"login":"speciose","id":8721324,"avatar_url":"https://avatars.githubusercontent.com/u/8721324?v=3","gravatar_id":"","url":"https://api.github.com/users/speciose","html_url":"https://github.com/speciose","followers_url":"https://api.github.com/users/speciose/followers","following_url":"https://api.github.com/users/speciose/following{/other_user}","gists_url":"https://api.github.com/users/speciose/gists{/gist_id}","starred_url":"https://api.github.com/users/speciose/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/speciose/subscriptions","organizations_url":"https://api.github.com/users/speciose/orgs","repos_url":"https://api.github.com/users/speciose/repos","events_url":"https://api.github.com/users/speciose/events{/privacy}","received_events_url":"https://api.github.com/users/speciose/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-14T18:31:43Z","updated_at":"2015-07-14T18:31:43Z","closed_at":null,"body":"Great package! But I have one question:\r\n\r\n### How secure this package?\r\nWe declare this fileResctrictions:\r\n```\r\nSlingshot.fileRestrictions(\"myFileUploads\", {\r\n  allowedFileTypes: [\"image/png\", \"image/jpeg\", \"image/gif\"],\r\n  maxSize: 10 * 1024 * 1024 // 10 MB (use null for unlimited).\r\n});\r\n```\r\nIs it possible for a user to upload some garbage that wouldn't be an image?\r\nBecause I'm using returned link and assign it to user avatar field. I'm scared that somebody will make \"broken image\" just for fun. Is it possible? Or amazon somehow will restrict anything that is not image (even if it has image extension). Thanks!"}}