When generating S3 presigned upload URLs for user avatars, always include a content-length-range condition in the policy document. Otherwise a client can take a valid presigned URL meant for a 2MB image and upload a 5GB file straight into your bucket.
commit 4610bb7