# Sniff + decode does not catch bytes after the image

input             : valid 16x16 PNG followed by 25 bytes of <script>
ImageVerifier     : ACCEPT (image/png)
why it is still OK: the object is stored as Content-Type image/png with
                    Content-Disposition: attachment, so a browser will not run it as HTML.
                    The check is the header, not the sniffing.