Separate upload entries per file, ALTCHA on POST, and stripped-or-original fallback on metadata errors.
Encrypt image bytes in the browser, keep keys out of POST bodies (URL fragment or path secret), and POST ciphertext via typed upload API helpers.