The Content-Type header sent by the browser is derived from the file extension and can be spoofed. Validate MIME type from file content using magic bytes via the UNIX `file` command or equivalent Ruby gems — in Shrine, by enabling the MIME-type plug-in and choosing an analyzer.