Hardening file uploads with MIME checks and storage isolation

                  allowed_types = ['image/png', 'image/jpeg', 'application/pdf']
uploaded = params.require(:document)

raise ActionController::BadRequest, 'file too large' if uploaded.size > 10.megabytes
raise ActionController::BadRequest, 'type not allowed' unless allowed_types.include?(uploaded.content_type)

filename = "#{SecureRandom.uuid}#{File.extname(uploaded.original_filename).downcase}"
storage_path = Rails.root.join('storage', 'uploads', filename)
File.binwrite(storage_path, uploaded.read)