- Detect SVG by content (magic bytes) in addition to MIME type to prevent sanitization bypass via mislabeled uploads - Add guard test verifying DOMPurify actually strips dirty payloads - Add looksLikeSvg detection test - Document REDIS_CACHE_DB in .env.example