bmersereau hardens Mike against three open security holes at once

The headline move is checking what files actually are, not just what they claim to be. bmersereau adds signature validation on both document upload paths, so a file's real bytes have to match its declared extension before Mike accepts it. PDFs, Word documents, and legacy .doc files pass; HTML pretending to be a contract, empty files, and anything unrecognized get turned away.

Behind that, the browser itself gets stricter rules about what it's allowed to run or embed, on both the backend and the Next.js frontend. So even if something hostile got past the front door, the browser would refuse to execute it or load it inside another page. A third strand pins a known-vulnerable XML parsing library to a patched version, clearing four high-severity advisories in one go.