Yeah, I agree with you that the production app likely had an async process, i.e. queuing submissions and processing them first-come-first-serve, which would hel

Yeah, I agree with you that the production app likely had an async process, i.e. queuing submissions and processing them first-come-first-serve, which would help explain why Dave didn't get the failure email until well into the next day. Seems safe to assume there was no process for (good) input validation upon upload. And now that I reread the passage about Dave, I realize it's not necessarily true that Dave tried to upload HEIC, then got an error message, which led him to then rename the file. But he may have actually read the instructions about PNG/JPG being required, then thought he could just rename his file, then uploaded it as his first and only upload to the demo app. And whether the demo app actually did the upload, it apparently didn't do the parsing (I still think that was stubbed out; I can imagine an engineer thinking it'd save a headache if they disabled the parsing module for the demo server)