Security · Binary Analysis · Next.js · 2026 · Solo — security research, TDD implementation, interaction design, deployment
MIME Dispatch
Unmask any file in one drop — magic bytes vs extension vs browser MIME, with a hex dump and risk verdict, 100% local.
The problem
File type masquerade attacks — renaming a malicious ELF binary as a JPEG, embedding ZIP payloads in image containers, or simply misconfiguring MIME types — are a persistent source of upload-handler bugs and supply-chain incidents. Most people have no quick way to see what a file actually is at the binary level without installing a system tool like `file`. MIME Dispatch puts that capability in the browser, locally, for any file.
Architecture
Key decisions
Browser-local File API with zero upload
All processing happens inside FileReader/arrayBuffer in the browser. No bytes leave the device. This is non-negotiable for a security-inspection tool — uploading the file to a server would defeat the purpose and introduce its own trust boundary.
Explicit byte-table over libmagic binding
A hand-authored signature table gives total control over what formats are recognised and why. It is auditable, testable in isolation, and produces human-readable signature strings. A WASM-compiled libmagic would be larger and harder to introspect in a TDD workflow.
Three-axis comparison for nuanced risk
Magic bytes alone are insufficient — a ZIP can be intentional or malicious depending on whether the extension says ZIP. Comparing magic, extension-mapped MIME, and browser-reported File.type together surfaces mismatch vectors that single-axis checks miss. HIGH risk is reserved for executable-category magic disguised as anything else.
Signature-byte highlighting in hex dump
Highlighting the exact bytes that drove the format decision (cyan in the hex pane) gives the user direct evidence rather than asking them to trust the verdict. It also makes the tool educational — users learn which bytes define which formats.