[mhurron]

> Why add more moving parts when they don't do anything but make more work?

Because in this case we're talking about intentionally accepting files from users to either integrate into the system or offer to other users. Why would you not at least check files for cleanness and reject any that fail instead of blindly accepting them because you wanted to enable file uploads.

Vulnerability scanning isn't going to tell you much when you want to accept files from users.