You can upload 147 file types, covering documents, images, video, audio, archives, design files, code, and data files. If a file type isn't on the approved list, it's blocked by default rather than allowed by exception.
28 file types are blocked because they can run programs or install software. This includes Windows executables (exe, dll, msi), Mac and Linux binaries (so, dylib, bin), auto-running scripts (bat, vbs, ps1), and mobile or desktop installers (apk, dmg, deb). These are blocked regardless of what the file claims to be.
Blocked file types run code the moment they're opened. That makes them the most common way malware spreads through shared files. The permitted list covers formats people actually need for business, like documents, spreadsheets, images, and code files, none of which execute on their own.
Yes. Source code (JavaScript, Python, Java, and others) and web files (HTML, CSS) were previously blocked. They're now permitted, in line with what other project tools allow.
No. Only 26 file types can display or play directly in the browser: images (except SVG), PDFs, video, audio, and plain text. Everything else, including all code and HTML files, downloads as a plain file. It cannot execute or run.
It's refused, with a message telling you the extension wasn't recognized. A file like "README" with no extension won't be accepted.
No. Only the final file extension is checked. A file named invoice.pdf.exe is read as an .exe file and blocked, even though "pdf" appears in the name.
No. PAYLOAD.EXE is blocked exactly the same as payload.exe. The check isn't case-sensitive.