---
title: Active upload or privileged preview may execute untrusted content
description: >-
  Investigates uploaded or imported active content that may execute in
  storefront, embedded admin, customer-account, or operator preview surfaces.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/active-uploads-and-privileged-previews
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/active-uploads-and-privileged-previews.md
---

# Active upload or privileged preview may execute untrusted content

Investigates uploaded or imported active content that may execute in storefront, embedded admin, customer-account, or operator preview surfaces.

| Detail | Value |
| - | - |
| Check ID | `ACTIVE_UPLOADS_AND_PRIVILEGED_PREVIEWS` |
| Severity | High |
| How it runs | Agent review |

***

## How to fix

Sanitize or re-encode active content and isolate previews from privileged origins.

**Don’t**

* Accept SVG, HTML, or XML and serve it back from the app's own origin.
* Trust the `Content-Type` the uploader sent, or the extension on the filename.
* Preview a merchant-supplied document inside the embedded admin, where it inherits that origin's authority.
* Rely on antivirus scanning alone as the control.

**Do**

* Re-encode what you accept. An uploaded image becomes a new PNG or JPEG your code writes; an SVG becomes a raster file or is rejected.
* Serve user files from a separate origin, with an explicit `Content-Type` and `Content-Disposition: attachment`.
* Verify the file signature, not the extension or the declared MIME type, and store under a name you generate.
* Render previews in a sandboxed iframe that holds no admin session.

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***