- Use os.path.basename() for filename sanitization instead of fragile blocklist - Replace ERROR_MESSAGES.DEFAULT(e) with generic error message in both except blocks to prevent CWE-209 information disclosure - Server-side logging via log.exception(e) is preserved for debugging