Today on developer life: app fails to upload any images because a WAF rule is blocking literally all requests for containing an "SQL injection pattern".
Turns out, that pattern is just the standard JPEG header produced when you compress at quality 80 with standard Android API's.
Yet the app is somehow the problem and must be fixed, instead of the WAF rule.
commit fec6789
JPEG headers getting flagged as SQLi is peak WAF energy. The most secure image upload is no image upload.