[SilverRed]

Can't you already attach arbitrary files as part of a tagged release? You can also direct link to any file you want which works the same as if it was uploaded. I'm not sure the file whitelist is adding any security here.