The internal file drop that can't serve a phishing page

Every company has a "just send me the file" channel, and every security team knows what it turns into: a URL that renders whatever was uploaded, including a login page that isn't yours.

hoody-pipe is the drop. Sending is curl -T, receiving is a GET, and the bytes never sit on a server in between. What matters is what the receiver's browser is allowed to do with them. Script-executable types, HTML, SVG, XML and the whole JavaScript MIME family, are rewritten to text/plain before a browser sees them. Inline Content-Disposition is coerced to attachment for anything outside an image, audio, video and plain-text safelist. Every response carries X-Content-Type-Options: nosniff and X-Robots-Tag: none. Access stays the proxy's job: IP allowlists, passwords, JWT.

The drop can carry a file, but it cannot carry a page.