# security: scan buffer for executable magic before persisting
    verdict, reason = att_svc.scan_for_malware(content, orig)
    if not verdict:
        raise HTTPException(status_code=400, detail=f"Rejected by malware scan: {reason}")

    is_html = kind == "html"
    html_body = ""
    if is_html:
        try:
            html_body = content.decode("utf-8")
        except UnicodeDecodeError:
            raise HTTPException(status_code=400, detail="HTML file is not valid UTF-8")
        problems = validate_html(html_body)
        if problems:  # validate_html returns a list of problem strings
            raise HTTPException(status_code=400,
                                detail=f"HTML rejected: {'; '.join(problems)}")
        # HTML attachments are stored inline (used with variable substitution at send time)