Done!

I also noted this wasn't documented anywhere; I've added a section to security.md on file uploads and documented it here, as well as making a reference to it in uploadfield.md