Know what a file is before you open it.

An extension is the suffix on a filename; a MIME type is metadata sent beside the bytes. They often agree, but neither proves what a file contains. A renamed executable can wear an innocent suffix, and a misconfigured server can send the right file under the wrong Content-Type. Verify untrusted downloads by inspecting their source and file signature, not only their name.

The profile headers include nosniff so browsers respect the declared type instead of guessing. Compressibility is registry guidance rather than a promise: test representative files, because small inputs or formats with internal compression can grow after another encoding pass.