Why it matters
A .pdf extension or MIME type does not make an uploaded document trustworthy. Malformed structures, active content and scanner failures all need explicit handling.
Secure Application Development // case study
PDFSentry
A defensive PDF quarantine and static-analysis workflow with layered inspection, explainable scoring and private reports.
What I built
PDFSentry streams authenticated uploads into webroot-external quarantine, creates analysis jobs and combines ClamAV, qpdf and pikepdf signals into an honest, traceable result.
03 / ProductCore
Core
capabilities
- 01
Authenticated PDF uploads up to 15 MB
- 02
Quarantine with normalized UUID filenames
- 03
Layered static inspection and antivirus scanning
- 04
0–100 scoring with private analysis reports
Clear boundaries.
Useful outcomes.
- Analysis runs outside the API process in a non-root worker
- Scanner outages can never produce a SAFE verdict
- Owner mismatches return 404 to reduce disclosure
- Bounded parsing, audit events and webroot-external storage
StackReact · FastAPI · PostgreSQL · Docker · ClamAV · qpdf · pikepdf
Secure file handling is a workflow, not a MIME check. Quarantine, ownership, bounded processing, failure semantics and verdict language have to agree across the full system.
Recursive embedded-object scanning, stale-job recovery, secure cookie authentication, stronger object-graph analysis and encrypted retention policies remain deliberate improvements.
Source code, setup instructions and the complete technical documentation are available in the repository.
Open repository ↗