[mariorod]

As you can guess there is a lot we do when it comes to attachments to keep the platform safe, which includes having an allow list of them. Now, I agree there is room for improvement and are looking into an attachment API that will address this.

[SilverRed]

Can't you already attach arbitrary files as part of a tagged release? You can also direct link to any file you want which works the same as if it was uploaded. I'm not sure the file whitelist is adding any security here.