When AI handles file paths based on user input, watch for traversal vulnerabilities:
file_path = f"uploads/{filename}"
If filename is "../../../etc/passwd", the attacker reads system files. Sanitize paths:
safe_name = os.path.basename(filename) file_path = os.path.join("uploads", safe_name)
The basename function strips directory components. Always validate that resolved paths stay within your expected directories.