Securing File Uploads in the Age of AI: Inside the pompelmi Project

File uploads remain one of the internet's oldest and most persistent security vulnerabilities, yet they're often overshadowed by flashier concerns like API security and authentication. As AI makes it easier than ever to generate malicious code, the humble file upload has become an increasingly critical attack vector that deserves renewed attention.

I recently spoke with Tommaso Bertocchi, creator of pompelmi, an open-source file scanning solution for Node.js applications. His insights reveal why file upload security deserves more attention and how modern tools are making it easier to implement.

The Overlooked Threat

When we think about application security today, we typically focus on network connections, user authentication, and API endpoints. File uploads seem like a solved problem from the early internet era—but that's precisely the misconception that makes them dangerous.

"File upload security is often overshadowed by network or API security, but it remains a critical attack vector that is frequently overlooked because of its perceived complexity," Bertocchi explains. "I created pompelmi because I noticed a significant gap: there were no modern, developer-friendly solutions that could be integrated quickly."

The risks go far beyond simply blocking .exe files. Weak upload handling can expose applications to unintended execution paths, denial-of-service attacks through resource-intensive files, and sophisticated bypasses of superficial validation checks. As Bertocchi notes, "This tends to happen most often when uploads are implemented quickly and rely on minimal validation."

Why Node.js?

While many security tools are written in compiled languages for performance reasons, Bertocchi chose Node.js for pompelmi based on developer experience considerations.

"The choice of Node.js was purely strategic and driven by Developer Experience (DX)," he says. "If I had built this in a language that compiles to bytecode, it would have introduced another layer of friction—requiring developers to manage external runtimes or complex IPC."

Since modern web development is heavily centered around the Node.js ecosystem, building pompelmi in the same language allows for native integration. "It lives where the code lives, ensuring that security doesn't feel like a clunky external chore."

Performance Without Compromise

One of pompelmi's key innovations is its ability to scan files without persisting them to disk, maintaining both security and speed.

"The core of pompelmi's performance lies in its in-process, stream-based architecture," Bertocchi explains. "We achieve this by using Node.js streams and configurable buffer limits to analyze file bytes directly in memory as they are uploaded, avoiding the heavy I/O overhead of disk writes."

The system also uses "magic bytes" to quickly identify file types and can terminate scans instantly when a file violates policies—such as ZIP bombs designed to consume excessive resources.

Balancing Flexibility and Usability

While pompelmi offers powerful features like YARA rule support and multiple composed scanners, Bertocchi recognized the need to prevent the "blank page" problem for users.

"To prevent the 'blank page' problem, pompelmi comes with built-in policy presets and a Common Heuristics Scanner," he says. "These handle the most frequent threats out of the box, such as ZIP bombs and MIME/Magic Byte verification."

The project provides standard YARA recipes and "reason codes" to explain why files are flagged, aiming for a "secure-by-default" experience where developers can start protected and then add custom rules as needed.

The Reality of Security Maintenance

When asked about keeping up with the latest security news, Bertocchi offers a pragmatic perspective.

"Keeping up with every new exploit in real time is difficult in practice, especially across many technologies," he says. "A more realistic approach is to implement a strong baseline that addresses common, repeatable failure modes."

This includes strict allowlists, server-side type validation, safe storage practices, resource and time bounds, and archive hardening. "Pompelmi is built around this layered, policy-driven approach—providing guardrails like server-side validation, archive checks, resource limits, and optional YARA-based scanning."

The Challenges of Solo Maintenance

As a solo maintainer, Bertocchi has experienced both the benefits and challenges of controlling the project's direction.

"Being the sole maintainer allows me the creative freedom to make swift decisions and keep the project's vision focused," he says. "However, I'm also realistic. My goal is to scale this from a personal project into a full-fledged organization."

He's actively seeking partnerships with established tech companies to provide the infrastructure and resources needed to transition the project to professional-grade standards.

Unexpected Complexities

The most challenging aspect of development wasn't the scanning algorithms themselves, but framework compatibility.

"The most unexpectedly challenging part was framework compatibility," Bertocchi reveals. "Each Node.js framework handles uploads differently—middleware vs. plugins, request/response lifecycles, body parsing, streaming vs in-memory buffers, and error-handling conventions."

Building pompelmi as a "drop-in" upload protection layer across multiple stacks required designing a consistent core policy and maintaining dedicated adapters for predictable behavior across environments.

The Future of File Upload Security

As AI continues to lower the barrier for creating malicious content, tools like pompelmi represent an important evolution in application security. By making file upload protection accessible and integrated into the development workflow, projects like this help ensure that security doesn't become an afterthought.

Bertocchi's approach—focusing on developer experience, providing sensible defaults, and building for framework compatibility—offers a model for how security tools should evolve. The goal isn't just to create powerful security features, but to make them so easy to use that developers actually implement them.

The file upload may seem like yesterday's problem, but as Bertocchi's work demonstrates, it remains one of today's most critical security challenges—and one that deserves our continued attention.