> SECURITY Validates **extension + MIME + magic bytes** (RIFF/WEBP) before any conversion. PNG conversion runs **in browser** for speed; GIF uses the **server API** at /api/convert. Max upload 50 MB (enforced by API & Nginx).