Agreed. Kyle, are you also validating that the content of the uploaded file correlates with the extension? Geocities began having real issues with bot generated accounts, each of which would get one shard of a binary warez uploaded as .jpg, etc. Of course, we didn't have captcha, so your exposure might be limited. Awesome to see this -- wish you worlds of luck.