A library with rules

Avatar Share is a free library of VRChat avatars, uploaded by the people who made them or shared under licences that allow it. The first idea was "any avatar, no restrictions", and I narrowed it on purpose: every upload carries a public licence attestation, there are upload caps, and nothing adult is allowed.

A unitypackage can run code on your machine

A .unitypackage is a gzipped tar of assets, and any script inside an Editor folder runs when it is imported. So every upload is streamed through a parser that reads only the file names, drains the asset bodies without buffering them, and flags DLLs and suspicious scripts before anything goes live.

A 600 MB package must never become 600 MB of memory. There is a test for that, and I checked that it fails against a deliberately broken parser, since a test that cannot fail proves nothing.

Two things that cost me time

Next.js 16 renamed middleware to proxy, and a proxy file silently truncates request bodies past 10 MB, so upload routes have to stay out of its matcher. Also, heap size does not measure Buffer leaks, because Buffers live outside the JavaScript heap.