@ivan Sorry, I was talking about the way Bonfire seemed to fetch images by following hyperlinks, not about files that were uploaded on an ActivityPub server.

But this might be far-fetched? What difference would it make with a malicious instance user uploading illegal files directly?