Edge Case Test Cases

🆕 New on stage — 2026-06-25 → 2026-07-01. Filename sanitization on every upload (sanitizeUploadFilename, #444/G16) neutralizes hostile names (path traversal, control chars, formula-injection style) before they reach S3 metadata or the audit row. Avatars/logos/payment proofs now store a bare S3 key and are presigned fresh on every read (#348/#406/#407/#451); legacy full-URL values still render without a backfill. A member's external avatar URL (non-S3 host) is now passed through untouched by the image-redirect service (#410). See TC-EDGE-003 and the Jun 25 release / Jul 1 release notes.