Short answer: validate an image as early as the client can do it, validate again after upload, and run OCR only on an object that passed both checks. Early checks save bandwidth; the second check is the security boundary because the uploaded bytes, metadata, and transformation path are now under your control. In a logistics community feed, people post photos of labels, damaged parcels, and delivery notes. The same image may be resized for a thumbnail, scanned for unsafe content, and sent to O...