- TestPNGScriptChunkNaming (no Docker) and TestStoreScriptChunkPNG (Postgres) pin the todo exploit: a decodable PNG with a script tEXt chunk uploaded in image mode as x.html is stored and served as .png, bytes unchanged - storage deploy note separates static servers (nosniff, nginx extension allow-list, 404 otherwise) from public buckets, which send the stored sniffed Content-Type; attachments.md points to it