Upload test cases, because uploads accept attacker controlled bytes

Type validation is the centre of gravity. The accept attribute on the input and the declared content type in the request are both supplied by the client and both trivially forged. The only reliable check inspects the file content itself, and it should refuse a mismatch between content and extension rather than trusting either alone.

Serving matters as much as accepting. Even a correctly identified file becomes dangerous if it is served inline from your primary domain with a guessable URL. The safer pattern is a separate domain for user content, an explicit content type, a download disposition for anything that does not need to render, and signed URLs with an expiry.

Interrupted transfers produce the most confusing support tickets. A truncated file that looks complete in a listing will fail later, during processing or when a customer downloads it, far from the upload that caused it. Test interruption and resume specifically, and assert byte identical downloads.

Two cases teams almost never write: metadata and deletion. Photographs carry GPS coordinates, so publishing them unstripped can expose a home address. And deletion that removes the database record while leaving bytes retrievable through a CDN is not deletion, which matters directly for data subject requests.