diff --git a/docs/architecture.md b/docs/architecture.md
index 3b6ee59a..40ac5042 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,102 +1,232 @@
-# Architecture Diagram
-
-```mermaid
-graph TB
-    Client[Client App] -->|HTTP/WS| Gateway[NestJS Gateway]
-
-    Gateway --> Auth[Auth Module]
-    Gateway --> Users[Users Module]
-    Gateway --> Properties[Properties Module]
-    Gateway --> Transactions[Transactions Module]
-    Gateway --> Documents[Documents Module]
-    Gateway --> Search[Search Module]
-    Gateway --> Admin[Admin Module]
-    Gateway --> Fraud[Fraud Module]
-    Gateway --> Notifications[Notifications Module]
-
-    Auth --> JWT[JWT Strategy]
-    Auth --> Google[Google OAuth]
-    Auth --> MFA[2FA / TOTP]
-    Auth --> RateLimit[Rate Limit Guard]
-    Auth --> APIKeys[API Key Management]
-
-    Users --> Prisma[(Prisma Client)]
-    Properties --> Prisma
-    Transactions --> Prisma
-    Documents --> Prisma
-    Search --> Prisma
-    Admin --> Prisma
-    Fraud --> Prisma
-
-    Prisma --> PostgreSQL[(PostgreSQL)]
-
-    Properties --> Blockchain[Blockchain Service]
-    Blockchain --> Ethereum[Ethereum / Sepolia]
-
-    Documents --> Uploads[File Uploads]
-    Uploads --> LocalFS[Local FS / S3]
-
-    Notifications --> WebSocket[WebSocket Gateway]
-    Notifications --> Email[Email Service]
-    Notifications --> SMS[SMS Service]
-
-    Fraud --> Email
-    Admin --> Backup[Backup Service]
-    Backup --> PgDump[pg_dump]
-
-    Search --> Cache[(Redis Cache)]
-    RateLimit --> Cache
-    Cache --> CacheWarming[Cache Warming]
-
-    Admin --> BullMQ[BullMQ Queues]
-    Transactions --> BullMQ
-
-    Gateway --> GraphQL[GraphQL / Apollo]
+# PropChain Backend Architecture
+
+## Tech Stack
+
+| Layer            | Technology                               |
+| ---------------- | ---------------------------------------- |
+| Runtime          | Node.js >= 18                            |
+| Framework        | NestJS 10                                |
+| Language         | TypeScript 5.3                           |
+| Database         | PostgreSQL (via Prisma ORM 6.x)          |
+| Cache            | Redis (via ioredis + cache-manager)      |
+| API              | REST (Express) + GraphQL (Apollo Server) |
+| Authentication   | Passport.js (JWT + Google OAuth2)        |
+| Blockchain       | Web3.js / Ethers.js 6                    |
+| Job Queue        | BullMQ (Redis-backed)                    |
+| Email            | Nodemailer via @nestjs-modules/mailer    |
+| Image Processing | Sharp                                    |
+| PDF Generation   | PDFKit                                   |
+| Documentation    | Swagger / OpenAPI                        |
+| Testing          | Jest + Supertest                         |
+| Monitoring       | Prometheus (prom-client)                 |
+| Realtime         | Socket.IO (WebSockets)                   |
+
+## Directory Structure
+
+```
+propchain-backend/
+├── prisma/
+│   ├── schema.prisma          # Database schema
+│   ├── seed.ts                # Seed script
+│   └── migrations/            # Migration history
+├── src/
+│   ├── main.ts                # Application bootstrap
+│   ├── app.module.ts          # Root module
+│   ├── app.controller.ts      # Health check / root routes
+│   ├── admin/                 # Admin panel & management
+│   ├── analytics/             # Search & property analytics
+│   ├── audit/                 # Audit logging
+│   ├── auth/                  # Auth (JWT, OAuth, guards, RBAC)
+│   ├── backup/                # Database backup/restore
+│   ├── blockchain/            # On-chain recording & verification
+│   ├── cache/                 # Redis caching layer
+│   ├── commissions/           # Agent commission tracking
+│   ├── common/                # Shared types, middleware, decorators
+│   ├── config/                # Swagger, env validation
+│   ├── content/               # Content management
+│   ├── dashboard/             # Dashboard aggregations
+│   ├── database/              # Prisma service & module
+│   ├── documents/             # Document upload, versioning, signing
+│   ├── duplicate-detection/   # Property duplicate detection
+│   ├── email/                 # Email sending
+│   ├── email-digest/          # Digest emails
+│   ├── favorites/             # User favorites/bookmarks
+│   ├── fraud/                 # Fraud detection & investigation
+│   ├── integrations/          # Third-party adapters
+│   ├── metrics/               # Prometheus metrics
+│   ├── mortgage-calculator/   # Mortgage estimation
+│   ├── neighborhoods/         # Neighborhoods, schools, amenities
+│   ├── notifications/         # Push, in-app, SMS notifications
+│   ├── open-house/            # Open house scheduling & RSVP
+│   ├── properties/            # Core property CRUD & images
+│   ├── property-comparison/   # Side-by-side comparison
+│   ├── property-views/        # View tracking & analytics
+│   ├── search/                # Full-text search & suggestions
+│   ├── sessions/              # User session management
+│   ├── support-tickets/       # Support ticket system
+│   ├── tracking/              # Link click tracking
+│   ├── transactions/          # Transaction lifecycle
+│   ├── trust-score/           # User trust scoring
+│   ├── types/                 # Shared TypeScript types
+│   ├── users/                 # User profiles & preferences
+│   ├── utils/                 # Utility functions
+│   ├── versioning/            # API versioning
+│   └── webhooks/              # Webhook management
+├── test/                      # E2E tests
+├── docs/                      # Developer documentation
+└── package.json
+```
+
+## Module Dependency Diagram
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                          AppModule                                  │
+│                                                                     │
+│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────────────┐   │
+│  │ Config   │  │ Prisma   │  │ GraphQL  │  │ ScheduleModule   │   │
+│  │ Module   │  │ Module   │  │ Module   │  │                  │   │
+│  └────┬─────┘  └────┬─────┘  └──────────┘  └──────────────────┘   │
+│       │              │                                              │
+│  ┌────▼──────────────▼────────────────────────────────────────────┐ │
+│  │                    Core Infrastructure                         │ │
+│  │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐     │ │
+│  │  │ Cache    │ │ Auth     │ │Database  │ │ Rate Limit   │     │ │
+│  │  │ Module   │ │ Module   │ │ Module   │ │ Service      │     │ │
+│  │  └──────────┘ └────┬─────┘ └──────────┘ └──────────────┘     │ │
+│  └─────────────────────┼─────────────────────────────────────────┘ │
+│                        │                                            │
+│  ┌─────────────────────▼─────────────────────────────────────────┐ │
+│  │                     Feature Modules                            │ │
+│  │                                                                │ │
+│  │  ┌───────────┐  ┌────────────┐  ┌──────────────────────┐     │ │
+│  │  │Properties │  │Transactions│  │     Documents        │     │ │
+│  │  │  Module   │──│   Module   │──│      Module          │     │ │
+│  │  └─────┬─────┘  └─────┬──────┘  └──────────────────────┘     │ │
+│  │        │               │                                       │ │
+│  │  ┌─────▼─────┐  ┌─────▼──────┐  ┌──────────────────────┐     │ │
+│  │  │Property   │  │Commissions │  │  Neighborhoods       │     │ │
+│  │  │ Images    │  │  Module    │  │     Module           │     │ │
+│  │  │  Module   │  └────────────┘  └──────────────────────┘     │ │
+│  │  └───────────┘                                                │ │
+│  │                                                                │ │
+│  │  ┌───────────┐  ┌────────────┐  ┌──────────────────────┐     │ │
+│  │  │Favorites  │  │  Search    │  │    Notifications     │     │ │
+│  │  │  Module   │  │  Module    │  │       Module         │     │ │
+│  │  └───────────┘  └────────────┘  └──────────────────────┘     │ │
+│  │                                                                │ │
+│  │  ┌───────────┐  ┌────────────┐  ┌──────────────────────┐     │ │
+│  │  │  Fraud    │  │  Blockchain│  │    Analytics         │     │ │
+│  │  │  Module   │  │  Module    │  │      Module          │     │ │
+│  │  └───────────┘  └────────────┘  └──────────────────────┘     │ │
+│  │                                                                │ │
+│  │  ┌───────────┐  ┌────────────┐  ┌──────────────────────┐     │ │
+│  │  │  Admin    │  │   Backup   │  │     Metrics          │     │ │
+│  │  │  Module   │  │  Module    │  │      Module          │     │ │
+│  │  └───────────┘  └────────────┘  └──────────────────────┘     │ │
+│  └───────────────────────────────────────────────────────────────┘ │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+## Data Flow Overview
+
+### Request Lifecycle
+
+```
+Client Request
+    │
+    ▼
+┌──────────────────┐
+│  Rate Limiting   │  IP-based + user-based throttling
+│  (Guard)         │
+└────────┬─────────┘
+         │
+         ▼
+┌──────────────────┐
+│  JWT Auth        │  Token validation, session check
+│  (Guard)         │
+└────────┬─────────┘
+         │
+         ▼
+┌──────────────────┐
+│  RBAC Guard      │  Role + permission checking
+└────────┬─────────┘
+         │
+         ▼
+┌──────────────────┐
+│  ValidationPipe  │  DTO validation, whitelisting
+│  (NestJS)        │
+└────────┬─────────┘
+         │
+         ▼
+┌──────────────────┐
+│  Controller      │  Route handling
+└────────┬─────────┘
+         │
+         ▼
+┌──────────────────┐
+│  Service         │  Business logic, authorization
+└────────┬─────────┘
+         │
+    ┌────┴────┐
+    ▼         ▼
+┌────────┐ ┌────────┐
+│ Prisma │ │ Redis  │
+│ (PostgreSQL)  │ Cache  │
+└────────┘ └────────┘
 ```
 
-## Request Flow
-
-```mermaid
-sequenceDiagram
-    participant C as Client
-    participant G as NestJS Gateway
-    participant RL as Rate Limit Guard
-    participant AU as Auth Service
-    participant S as Feature Service
-    participant DB as PostgreSQL
-    participant BC as Blockchain
-
-    C->>G: HTTP Request
-    G->>RL: canActivate()
-    RL->>RL: Check Redis counters
-    alt Rate limit exceeded
-        RL-->>C: 429 Too Many Requests
-    else Within limits
-        RL->>G: Allow
-        G->>AU: Validate JWT
-        AU->>AU: Verify token + roles
-        AU->>G: Authenticated context
-        G->>S: Handle request
-        S->>DB: Query/Mutate
-        DB-->>S: Result
-        alt Blockchain required
-            S->>BC: Record transaction
-            BC-->>S: Tx hash
-        end
-        S-->>C: Response
-    end
+### Property Image Pipeline
+
 ```
+Upload (multer/memory buffer)
+    │
+    ▼
+┌──────────────────────┐
+│ Validate             │  Size, mime type, per-property cap
+└──────────┬───────────┘
+           │
+           ▼
+┌──────────────────────┐
+│ Sharp Pipeline        │  Auto-rotate, resize, convert
+│ ├── Full (1920px)    │  WebP quality 85
+│ ├── Medium (800px)   │  WebP quality 80
+│ └── Thumbnail (300px)│  WebP quality 75
+│ Strip EXIF metadata   │  Privacy protection
+└──────────┬───────────┘
+           │
+           ▼
+┌──────────────────────┐
+│ Duplicate Detection   │  Perceptual hash (SHA-256 prefix)
+└──────────┬───────────┘
+           │
+           ▼
+┌──────────────────────┐
+│ Persist to DB + Disk │  PropertyImage record + files on disk
+└──────────────────────┘
+```
+
+### Transaction Lifecycle
+
+```
+PENDING → UNDER_CONTRACT → COMPLETED
+   │              │
+   └── CANCELLED ─┘
+
+Each state change:
+  1. Validate transition (status machine)
+  2. Update property status
+  3. Record transaction history
+  4. Emit notifications
+  5. Optional: record on blockchain
+```
+
+## Key Design Decisions
 
-## Module Relationships
-
-| Module | Depends On | Provides |
-|--------|-----------|----------|
-| Auth | Users, JWT, Redis | Authentication, 2FA, API keys |
-| Users | Prisma | User CRUD, profiles |
-| Properties | Prisma, Blockchain, Geocoding | Property listings, images |
-| Transactions | Prisma, Blockchain | Transaction lifecycle |
-| Documents | Prisma, Uploads | Document management, signing |
-| Search | Prisma, Redis | Full-text search, facets, autocomplete |
-| Fraud | Prisma, Email | Fraud detection, alerts, auto-block |
-| Admin | Prisma, Backup, BullMQ | Admin ops, backups, reports |
-| Notifications | WebSocket, Email, SMS | Real-time + async notifications |
+1. **Dual API Surface**: REST (primary) + GraphQL (queries/subscriptions)
+2. **Prisma as Single Source of Truth**: All DB access through PrismaService
+3. **Decorator-based RBAC**: `@RequirePermissions()` for endpoint authorization
+4. **Event-Driven Notifications**: WebSocket gateway for real-time delivery
+5. **Blockchain as Audit Trail**: Optional on-chain recording for transactions
+6. **Image Variants via Sharp**: Three sizes generated at upload time, stored on disk
+7. **Fraud Detection Pipeline**: Pattern matching with configurable severity levels
diff --git a/package.json b/package.json
index 9136e568..ac129317 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,6 @@
     "jsonwebtoken": "^9.0.2",
     "keyv": "^5.6.0",
     "multer": "^2.2.0",
-    "nodemailer": "^8.0.7",
     "nodemailer": "^9.0.1",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0",
diff --git a/src/cache/cache-headers.interceptor.ts b/src/cache/cache-headers.interceptor.ts
index 50aec430..a0b8f01a 100644
--- a/src/cache/cache-headers.interceptor.ts
+++ b/src/cache/cache-headers.interceptor.ts
@@ -4,16 +4,38 @@ import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nes
 import { Observable } from 'rxjs';
 import { tap } from 'rxjs/operators';
 
+const IMAGE_CACHE_DURATIONS: Record<string, number> = {
+  'image/avif': 86400 * 30,
+  'image/webp': 86400 * 7,
+  'image/jpeg': 3600,
+  'image/png': 3600,
+  'image/gif': 3600,
+};
+
 @Injectable()
 export class CacheHeadersInterceptor implements NestInterceptor {
   intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
     const res = context.switchToHttp().getResponse();
+    const req = context.switchToHttp().getRequest();
     const start = Date.now();
 
     return next.handle().pipe(
       tap(() => {
         res.setHeader('X-Cache-Time', `${Date.now() - start}ms`);
-        res.setHeader('Cache-Control', 'public, max-age=60');
+
+        const contentType = res.getHeader('content-type') as string | undefined;
+        const isImageResponse =
+          contentType?.startsWith('image/') ||
+          req.path?.includes('/uploads/');
+
+        if (isImageResponse) {
+          const format = contentType?.split(';')[0]?.trim() || 'image/jpeg';
+          const maxAge = IMAGE_CACHE_DURATIONS[format] || 3600;
+          res.setHeader('Cache-Control', `public, max-age=${maxAge}`);
+          res.setHeader('Vary', 'Accept');
+        } else {
+          res.setHeader('Cache-Control', 'public, max-age=60');
+        }
       }),
     );
   }
diff --git a/src/documents/document-upload.service.spec.ts b/src/documents/document-upload.service.spec.ts
index 9b8bd619..78e254c8 100644
--- a/src/documents/document-upload.service.spec.ts
+++ b/src/documents/document-upload.service.spec.ts
@@ -40,10 +40,10 @@ describe('DocumentUploadService', () => {
       const req: UploadRequest = {
         fileName: 'large.pdf',
         mimeType: 'application/pdf',
-        fileSizeBytes: 11 * 1024 * 1024,
+        fileSizeBytes: 30 * 1024 * 1024,
       };
       expect(() => service.validate(req)).toThrow(BadRequestException);
-      expect(() => service.validate(req)).toThrow('File exceeds maximum allowed size');
+      expect(() => service.validate(req)).toThrow('File exceeds maximum allowed size of 25 MB for application/pdf');
     });
 
     it('should throw BadRequestException for empty file name', () => {
@@ -55,6 +55,34 @@ describe('DocumentUploadService', () => {
       expect(() => service.validate(req)).toThrow(BadRequestException);
       expect(() => service.validate(req)).toThrow('File name cannot be empty');
     });
+
+    it('should throw BadRequestException for zero size file', () => {
+      const req: UploadRequest = {
+        fileName: 'empty.pdf',
+        mimeType: 'application/pdf',
+        fileSizeBytes: 0,
+      };
+      expect(() => service.validate(req)).toThrow(BadRequestException);
+      expect(() => service.validate(req)).toThrow('File size must be greater than zero');
+    });
+
+    it('should enforce type-specific size limits for images', () => {
+      const req: UploadRequest = {
+        fileName: 'big.png',
+        mimeType: 'image/png',
+        fileSizeBytes: 15 * 1024 * 1024,
+      };
+      expect(() => service.validate(req)).toThrow(BadRequestException);
+    });
+
+    it('should enforce type-specific size limits for docs', () => {
+      const req: UploadRequest = {
+        fileName: 'big.doc',
+        mimeType: 'application/msword',
+        fileSizeBytes: 20 * 1024 * 1024,
+      };
+      expect(() => service.validate(req)).toThrow(BadRequestException);
+    });
   });
 
   describe('prepareMetadata', () => {
@@ -72,4 +100,120 @@ describe('DocumentUploadService', () => {
       expect(result).toHaveProperty('uploadedAt');
     });
   });
+
+  describe('validateMagicBytes', () => {
+    it('should validate PDF magic bytes', () => {
+      const pdfBuffer = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x34]);
+      expect(service.validateMagicBytes(pdfBuffer, 'application/pdf')).toBe(true);
+    });
+
+    it('should reject wrong magic bytes', () => {
+      const buf = Buffer.from([0x00, 0x00, 0x00, 0x00]);
+      expect(service.validateMagicBytes(buf, 'application/pdf')).toBe(false);
+    });
+
+    it('should validate JPEG magic bytes', () => {
+      const jpegBuffer = Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10]);
+      expect(service.validateMagicBytes(jpegBuffer, 'image/jpeg')).toBe(true);
+    });
+
+    it('should validate PNG magic bytes', () => {
+      const pngBuffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+      expect(service.validateMagicBytes(pngBuffer, 'image/png')).toBe(true);
+    });
+
+    it('should validate WebP magic bytes', () => {
+      const webpBuffer = Buffer.from([0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00]);
+      expect(service.validateMagicBytes(webpBuffer, 'image/webp')).toBe(true);
+    });
+
+    it('should return true for unknown MIME types', () => {
+      const buf = Buffer.from([0x00, 0x00]);
+      expect(service.validateMagicBytes(buf, 'application/octet-stream')).toBe(true);
+    });
+
+    it('should handle buffer shorter than signature', () => {
+      const shortBuf = Buffer.from([0x25]);
+      expect(service.validateMagicBytes(shortBuf, 'application/pdf')).toBe(false);
+    });
+  });
+
+  describe('sanitizeFilename', () => {
+    it('should remove path traversal sequences', () => {
+      expect(service.sanitizeFilename('../../../etc/passwd')).not.toContain('..');
+    });
+
+    it('should remove null bytes', () => {
+      expect(service.sanitizeFilename('file\x00name.pdf')).not.toContain('\x00');
+    });
+
+    it('should remove slashes', () => {
+      expect(service.sanitizeFilename('path/to/file.pdf')).not.toContain('/');
+    });
+
+    it('should replace special characters with underscores', () => {
+      const result = service.sanitizeFilename('hello world!@#.pdf');
+      expect(result).not.toContain(' ');
+      expect(result).not.toContain('!');
+    });
+
+    it('should handle empty input with fallback', () => {
+      const result = service.sanitizeFilename('...');
+      expect(result).toMatch(/^upload_\d+$/);
+    });
+
+    it('should lowercase output', () => {
+      expect(service.sanitizeFilename('FILE.PDF')).toBe('file.pdf');
+    });
+  });
+
+  describe('validateFileSize', () => {
+    it('should pass for files within limits', () => {
+      const buf = Buffer.alloc(1024);
+      expect(() => service.validateFileSize(buf, 'application/pdf')).not.toThrow();
+    });
+
+    it('should throw for oversized files', () => {
+      const buf = Buffer.alloc(30 * 1024 * 1024);
+      expect(() => service.validateFileSize(buf, 'application/pdf')).toThrow(BadRequestException);
+    });
+  });
+
+  describe('scanForThreats', () => {
+    it('should detect script tags', () => {
+      const buf = Buffer.from('<script>alert("xss")</script>');
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(false);
+    });
+
+    it('should detect javascript protocol', () => {
+      const buf = Buffer.from('javascript:void(0)');
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(false);
+    });
+
+    it('should detect iframe tags', () => {
+      const buf = Buffer.from('<iframe src="evil.com">');
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(false);
+    });
+
+    it('should detect object tags', () => {
+      const buf = Buffer.from('<object data="evil.swf">');
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(false);
+    });
+
+    it('should return safe for clean content', () => {
+      const buf = Buffer.from('Hello world, this is a normal document.');
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(true);
+    });
+
+    it('should handle binary content without false positives', () => {
+      const buf = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+      const result = service.scanForThreats(buf);
+      expect(result.safe).toBe(true);
+    });
+  });
 });
diff --git a/src/documents/document-upload.service.ts b/src/documents/document-upload.service.ts
index 4b574744..a81e94c9 100644
--- a/src/documents/document-upload.service.ts
+++ b/src/documents/document-upload.service.ts
@@ -1,17 +1,50 @@
 // @ts-nocheck
 
-import { Injectable, BadRequestException } from '@nestjs/common';
+import { Injectable, BadRequestException, Logger } from '@nestjs/common';
 
 const ALLOWED_MIME_TYPES = new Set([
   'application/pdf',
   'image/jpeg',
   'image/png',
   'image/webp',
+  'image/avif',
   'application/msword',
   'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
 ]);
 
-const MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024; // 10 MB
+const MIME_SIZE_LIMITS: Record<string, number> = {
+  'image/jpeg': 10 * 1024 * 1024,
+  'image/png': 10 * 1024 * 1024,
+  'image/webp': 10 * 1024 * 1024,
+  'image/avif': 10 * 1024 * 1024,
+  'application/pdf': 25 * 1024 * 1024,
+  'application/msword': 15 * 1024 * 1024,
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 15 * 1024 * 1024,
+};
+
+const MAGIC_BYTES: Record<string, number[][]> = {
+  'application/pdf': [[0x25, 0x50, 0x44, 0x46]],
+  'image/jpeg': [[0xff, 0xd8, 0xff]],
+  'image/png': [
+    [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
+  ],
+  'image/webp': [
+    [0x52, 0x49, 0x46, 0x46],
+  ],
+  'image/avif': [
+    [0x00, 0x00, 0x00],
+  ],
+};
+
+const THREAT_PATTERNS = [
+  /<script[\s>]/i,
+  /javascript:/i,
+  /on\w+\s*=/i,
+  /<iframe[\s>]/i,
+  /<object[\s>]/i,
+  /<embed[\s>]/i,
+  /<applet[\s>]/i,
+];
 
 export interface UploadRequest {
   fileName: string;
@@ -29,13 +62,19 @@ export interface UploadMetadata {
 
 @Injectable()
 export class DocumentUploadService {
+  private readonly logger = new Logger(DocumentUploadService.name);
+
   validate(request: UploadRequest): void {
     if (!ALLOWED_MIME_TYPES.has(request.mimeType)) {
       throw new BadRequestException(`Unsupported file type: ${request.mimeType}`);
     }
-    if (request.fileSizeBytes > MAX_FILE_SIZE_BYTES) {
+    if (request.fileSizeBytes <= 0) {
+      throw new BadRequestException('File size must be greater than zero');
+    }
+    const limit = MIME_SIZE_LIMITS[request.mimeType] ?? 10 * 1024 * 1024;
+    if (request.fileSizeBytes > limit) {
       throw new BadRequestException(
-        `File exceeds maximum allowed size of ${MAX_FILE_SIZE_BYTES / (1024 * 1024)} MB`,
+        `File exceeds maximum allowed size of ${Math.round(limit / (1024 * 1024))} MB for ${request.mimeType}`,
       );
     }
     if (!request.fileName.trim()) {
@@ -45,10 +84,7 @@ export class DocumentUploadService {
 
   prepareMetadata(request: UploadRequest): UploadMetadata {
     this.validate(request);
-    const sanitisedName = request.fileName
-      .trim()
-      .replace(/[^a-zA-Z0-9._-]/g, '_')
-      .toLowerCase();
+    const sanitisedName = this.sanitizeFilename(request.fileName);
 
     return {
       ...request,
@@ -56,4 +92,73 @@ export class DocumentUploadService {
       uploadedAt: new Date().toISOString(),
     };
   }
+
+  /**
+   * Validate file signature (magic bytes) against the expected MIME type.
+   */
+  validateMagicBytes(buffer: Buffer, expectedMime: string): boolean {
+    const signatures = MAGIC_BYTES[expectedMime];
+    if (!signatures) {
+      return true;
+    }
+    for (const sig of signatures) {
+      if (buffer.length < sig.length) {
+        continue;
+      }
+      let match = true;
+      for (let i = 0; i < sig.length; i++) {
+        if (buffer[i] !== sig[i]) {
+          match = false;
+          break;
+        }
+      }
+      if (match) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Enhanced filename sanitization with path traversal prevention.
+   */
+  sanitizeFilename(filename: string): string {
+    let name = filename.trim();
+    name = name.replace(/\0/g, '');
+    name = name.replace(/\.\./g, '');
+    name = name.replace(/[/\\]/g, '');
+    name = name.replace(/[^a-zA-Z0-9._-]/g, '_');
+    name = name.replace(/_{2,}/g, '_');
+    name = name.replace(/^[._-]+/, '');
+    if (!name || name.length === 0) {
+      name = `upload_${Date.now()}`;
+    }
+    return name.toLowerCase();
+  }
+
+  /**
+   * Validate file size against type-specific limits.
+   */
+  validateFileSize(buffer: Buffer, mimeType: string): void {
+    const limit = MIME_SIZE_LIMITS[mimeType] ?? 10 * 1024 * 1024;
+    if (buffer.length > limit) {
+      throw new BadRequestException(
+        `File size ${Math.round(buffer.length / (1024 * 1024))}MB exceeds limit of ${Math.round(limit / (1024 * 1024))}MB for ${mimeType}`,
+      );
+    }
+  }
+
+  /**
+   * Basic malware/threat scan looking for embedded scripts and suspicious patterns.
+   */
+  scanForThreats(buffer: Buffer): { safe: boolean; reason?: string } {
+    const content = buffer.toString('utf-8', 0, Math.min(buffer.length, 1024 * 1024));
+    for (const pattern of THREAT_PATTERNS) {
+      if (pattern.test(content)) {
+        this.logger.warn(`Threat pattern detected: ${pattern.source}`);
+        return { safe: false, reason: `Potentially dangerous pattern detected: ${pattern.source}` };
+      }
+    }
+    return { safe: true };
+  }
 }
diff --git a/src/documents/documents.module.ts b/src/documents/documents.module.ts
index a616cb9d..c63fc02d 100644
--- a/src/documents/documents.module.ts
+++ b/src/documents/documents.module.ts
@@ -3,6 +3,7 @@
 import { Module } from '@nestjs/common';
 import { DocumentsService } from './documents.service';
 import { DocumentsController } from './documents.controller';
+import { DocumentUploadService } from './document-upload.service';
 import { PrismaModule } from '../database/prisma.module';
 import { AuthModule } from '../auth/auth.module';
 import { SignedUrlService } from './signed-url/signed-url.service';
@@ -44,12 +45,13 @@ function signedUrlProviderFactory(): new (...args: any[]) => SignedUrlProvider {
   controllers: [DocumentsController, DocumentsDownloadController],
   providers: [
     DocumentsService,
+    DocumentUploadService,
     SignedUrlService,
     {
       provide: SIGNED_URL_PROVIDER_TOKEN,
       useClass: signedUrlProviderFactory(),
     },
   ],
-  exports: [DocumentsService],
+  exports: [DocumentsService, DocumentUploadService],
 })
 export class DocumentsModule {}
diff --git a/src/notifications/notifications.module.ts b/src/notifications/notifications.module.ts
index 1717d979..9aac7755 100644
--- a/src/notifications/notifications.module.ts
+++ b/src/notifications/notifications.module.ts
@@ -1,18 +1,33 @@
 // @ts-nocheck
 
 import { Module, forwardRef } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
 import { NotificationsGateway } from './notifications.gateway';
 import { NotificationsService } from './notifications.service';
 import { NotificationsController } from './notifications.controller';
-import { SmsService } from './sms.service';
+import {
+  SmsService,
+  SmsProviderFactory,
+  TwilioSmsProvider,
+  AwsSnsSmsProvider,
+  MockSmsProvider,
+} from './sms.service';
 import { PrismaModule } from '../database/prisma.module';
 import { EmailModule } from '../email/email.module';
 import { UsersModule } from '../users/users.module';
 
 @Module({
-  imports: [PrismaModule, EmailModule, UsersModule],
+  imports: [PrismaModule, EmailModule, UsersModule, ConfigModule],
   controllers: [NotificationsController],
-  providers: [NotificationsGateway, NotificationsService, SmsService],
-  exports: [NotificationsService, SmsService],
+  providers: [
+    NotificationsGateway,
+    NotificationsService,
+    TwilioSmsProvider,
+    AwsSnsSmsProvider,
+    MockSmsProvider,
+    SmsProviderFactory,
+    SmsService,
+  ],
+  exports: [NotificationsService, SmsService, SmsProviderFactory],
 })
 export class NotificationsModule {}
diff --git a/src/notifications/sms.service.ts b/src/notifications/sms.service.ts
index 921fa478..d85f64d5 100644
--- a/src/notifications/sms.service.ts
+++ b/src/notifications/sms.service.ts
@@ -1,17 +1,362 @@
 // @ts-nocheck
 
-import { Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger, BadRequestException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { promises as fs } from 'fs';
+import { join } from 'path';
+
+export interface SmsResult {
+  success: boolean;
+  messageId?: string;
+  error?: string;
+}
+
+export interface SmsProvider {
+  send(to: string, message: string): Promise<SmsResult>;
+}
+
+// ---------------------------------------------------------------------------
+// Twilio provider
+// ---------------------------------------------------------------------------
+
+@Injectable()
+export class TwilioSmsProvider implements SmsProvider {
+  private readonly logger = new Logger(TwilioSmsProvider.name);
+  private readonly accountSid: string;
+  private readonly authToken: string;
+  private readonly fromNumber: string;
+
+  constructor(private readonly configService: ConfigService) {
+    this.accountSid = this.configService.get<string>('TWILIO_ACCOUNT_SID', '');
+    this.authToken = this.configService.get<string>('TWILIO_AUTH_TOKEN', '');
+    this.fromNumber = this.configService.get<string>('TWILIO_FROM_NUMBER', '');
+  }
+
+  async send(to: string, message: string): Promise<SmsResult> {
+    try {
+      const credentials = Buffer.from(`${this.accountSid}:${this.authToken}`).toString('base64');
+      const params = new URLSearchParams();
+      params.append('To', to);
+      params.append('From', this.fromNumber);
+      params.append('Body', message);
+
+      const response = await fetch(
+        `https://api.twilio.com/2010-04-01/Accounts/${this.accountSid}/Messages.json`,
+        {
+          method: 'POST',
+          headers: {
+            Authorization: `Basic ${credentials}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          body: params.toString(),
+        },
+      );
+
+      if (!response.ok) {
+        const body = await response.text();
+        this.logger.error(`Twilio error: ${body}`);
+        return { success: false, error: `Twilio API error: ${response.status}` };
+      }
+
+      const data = (await response.json()) as any;
+      this.logger.log(`SMS sent via Twilio: ${data.sid}`);
+      return { success: true, messageId: data.sid };
+    } catch (err) {
+      this.logger.error(`Twilio send failed: ${(err as Error).message}`);
+      return { success: false, error: (err as Error).message };
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// AWS SNS provider
+// ---------------------------------------------------------------------------
+
+@Injectable()
+export class AwsSnsSmsProvider implements SmsProvider {
+  private readonly logger = new Logger(AwsSnsSmsProvider.name);
+  private readonly region: string;
+  private readonly accessKeyId: string;
+  private readonly secretAccessKey: string;
+
+  constructor(private readonly configService: ConfigService) {
+    this.region = this.configService.get<string>('AWS_REGION', 'us-east-1');
+    this.accessKeyId = this.configService.get<string>('AWS_ACCESS_KEY_ID', '');
+    this.secretAccessKey = this.configService.get<string>('AWS_SECRET_ACCESS_KEY', '');
+  }
+
+  async send(to: string, message: string): Promise<SmsResult> {
+    try {
+      const timestamp = new Date().toISOString().replace(/[:\-]|\.\d{3}/g, '');
+      const dateStamp = timestamp.slice(0, 8);
+      const amzDate = timestamp.slice(0, 15) + 'Z';
+      const service = 'sns';
+      const region = this.region;
+      const host = `sns.${region}.amazonaws.com`;
+
+      const params: Record<string, string> = {
+        Action: 'Publish',
+        Message: message,
+        PhoneNumber: to,
+        Version: '2010-03-31',
+      };
+
+      const sortedParams = Object.keys(params)
+        .sort()
+        .map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(params[k])}`)
+        .join('&');
+
+      const canonicalRequest = [
+        'POST',
+        '/',
+        '',
+        `host:${host}\n`,
+        'host',
+        await this.sha256(sortedParams),
+      ].join('\n');
+
+      const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+      const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        amzDate,
+        credentialScope,
+        await this.sha256(canonicalRequest),
+      ].join('\n');
+
+      const kDate = await this.hmac(`AWS4${this.secretAccessKey}`, dateStamp);
+      const kRegion = await this.hmac(kDate, region);
+      const kService = await this.hmac(kRegion, service);
+      const kSigning = await this.hmac(kService, 'aws4_request');
+      const signature = await this.hmacHex(kSigning, stringToSign);
+
+      const authorizationHeader = [
+        `AWS4-HMAC-SHA256 Credential=${this.accessKeyId}/${credentialScope}`,
+        'SignedHeaders=host',
+        `Signature=${signature}`,
+      ].join(', ');
+
+      const response = await fetch(`https://${host}/?${sortedParams}`, {
+        method: 'POST',
+        headers: {
+          Authorization: authorizationHeader,
+          'X-Amz-Date': amzDate,
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Host: host,
+        },
+      });
+
+      if (!response.ok) {
+        const body = await response.text();
+        this.logger.error(`AWS SNS error: ${body}`);
+        return { success: false, error: `AWS SNS API error: ${response.status}` };
+      }
+
+      const bodyText = await response.text();
+      const messageIdMatch = bodyText.match(/<MessageId>(.+?)<\/MessageId>/);
+      const messageId = messageIdMatch?.[1];
+      this.logger.log(`SMS sent via AWS SNS: ${messageId}`);
+      return { success: true, messageId };
+    } catch (err) {
+      this.logger.error(`AWS SNS send failed: ${(err as Error).message}`);
+      return { success: false, error: (err as Error).message };
+    }
+  }
+
+  private async sha256(data: string): Promise<string> {
+    const { createHash } = await import('crypto');
+    return createHash('sha256').update(data).digest('hex');
+  }
+
+  private async hmac(key: string | Buffer, data: string): Promise<Buffer> {
+    const { createHmac } = await import('crypto');
+    return createHmac('sha256', key).update(data).digest();
+  }
+
+  private async hmacHex(key: Buffer, data: string): Promise<string> {
+    const { createHmac } = await import('crypto');
+    return createHmac('sha256', key).update(data).digest('hex');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Mock provider (for dev/testing)
+// ---------------------------------------------------------------------------
+
+@Injectable()
+export class MockSmsProvider implements SmsProvider {
+  private readonly logger = new Logger(MockSmsProvider.name);
+
+  async send(to: string, message: string): Promise<SmsResult> {
+    this.logger.log(`[MOCK SMS] To: ${to} | Message: ${message}`);
+    return { success: true, messageId: `mock-${Date.now()}` };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+
+@Injectable()
+export class SmsProviderFactory {
+  private readonly provider: SmsProvider;
+
+  constructor(
+    private readonly configService: ConfigService,
+    private readonly twilioProvider: TwilioSmsProvider,
+    private readonly awsProvider: AwsSnsSmsProvider,
+    private readonly mockProvider: MockSmsProvider,
+  ) {
+    const providerName = this.configService.get<string>('SMS_PROVIDER', 'mock').toLowerCase();
+    switch (providerName) {
+      case 'twilio':
+        this.provider = twilioProvider;
+        break;
+      case 'aws':
+        this.provider = awsProvider;
+        break;
+      default:
+        this.provider = mockProvider;
+        break;
+    }
+  }
+
+  getProvider(): SmsProvider {
+    return this.provider;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Rate limiter helper
+// ---------------------------------------------------------------------------
+
+interface RateLimitEntry {
+  timestamps: number[];
+}
+
+// ---------------------------------------------------------------------------
+// SMS Service (enhanced)
+// ---------------------------------------------------------------------------
 
 @Injectable()
 export class SmsService {
   private readonly logger = new Logger(SmsService.name);
 
-  async sendSms(to: string, message: string): Promise<boolean> {
-    // Mock implementation for SMS delivery
-    // In a production environment, this would integrate with a provider like Twilio, Vonage, or AWS SNS.
-    this.logger.log(`📱 Sending SMS to ${to}: ${message}`);
+  private readonly optedOutPhones = new Set<string>();
+  private readonly rateLimitMap = new Map<string, RateLimitEntry>();
+  private readonly maxPerMinute = 10;
+  private readonly optOutStoragePath: string;
+
+  constructor(
+    private readonly smsProviderFactory: SmsProviderFactory,
+    private readonly configService: ConfigService,
+  ) {
+    this.optOutStoragePath = this.configService.get<string>(
+      'SMS_OPTOUT_STORAGE',
+      './data/sms-optout.json',
+    );
+    this.loadOptOutList();
+  }
+
+  async sendSms(to: string, message: string): Promise<SmsResult> {
+    const normalized = this.normalizePhone(to);
+    if (!this.validatePhoneNumber(normalized)) {
+      throw new BadRequestException(`Invalid phone number: ${to}`);
+    }
+    if (this.isOptedOut(normalized)) {
+      this.logger.warn(`SMS skipped: ${normalized} has opted out`);
+      return { success: false, error: 'Phone number has opted out of SMS' };
+    }
+    if (!this.checkRateLimit(normalized)) {
+      this.logger.warn(`SMS rate limited for ${normalized}`);
+      return { success: false, error: 'Rate limit exceeded (max 10 SMS per minute)' };
+    }
+
+    const result = await this.smsProviderFactory.getProvider().send(normalized, message);
+    if (result.success) {
+      this.recordSend(normalized);
+    }
+    return result;
+  }
+
+  /**
+   * Validate phone number format (E.164 or basic digits).
+   */
+  validatePhoneNumber(phone: string): boolean {
+    if (!phone || phone.length < 7 || phone.length > 15) {
+      return false;
+    }
+    const cleaned = phone.replace(/[\s\-().]/g, '');
+    return /^\+?\d{7,15}$/.test(cleaned);
+  }
+
+  /**
+   * Handle opt-out request from a phone number.
+   */
+  async handleOptOut(phone: string): Promise<void> {
+    const normalized = this.normalizePhone(phone);
+    this.optedOutPhones.add(normalized);
+    await this.persistOptOutList();
+    this.logger.log(`Phone ${normalized} opted out of SMS`);
+  }
+
+  /**
+   * Check if a phone number has opted out.
+   */
+  isOptedOut(phone: string): boolean {
+    return this.optedOutPhones.has(this.normalizePhone(phone));
+  }
+
+  // ---------------------------------------------------------------------------
+  // Rate limiting
+  // ---------------------------------------------------------------------------
+
+  private checkRateLimit(phone: string): boolean {
+    const now = Date.now();
+    const windowMs = 60 * 1000;
+    let entry = this.rateLimitMap.get(phone);
+    if (!entry) {
+      entry = { timestamps: [] };
+      this.rateLimitMap.set(phone, entry);
+    }
+    entry.timestamps = entry.timestamps.filter((ts) => now - ts < windowMs);
+    return entry.timestamps.length < this.maxPerMinute;
+  }
+
+  private recordSend(phone: string): void {
+    let entry = this.rateLimitMap.get(phone);
+    if (!entry) {
+      entry = { timestamps: [] };
+      this.rateLimitMap.set(phone, entry);
+    }
+    entry.timestamps.push(Date.now());
+  }
+
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+
+  private normalizePhone(phone: string): string {
+    return phone.replace(/[\s\-()]/g, '');
+  }
+
+  private async loadOptOutList(): Promise<void> {
+    try {
+      const data = await fs.readFile(this.optOutStoragePath, 'utf-8');
+      const phones = JSON.parse(data) as string[];
+      phones.forEach((p) => this.optedOutPhones.add(p));
+      this.logger.log(`Loaded ${phones.length} opted-out phone numbers`);
+    } catch {
+      // File may not exist yet; that's fine.
+    }
+  }
 
-    // Simulate successful delivery
-    return true;
+  private async persistOptOutList(): Promise<void> {
+    try {
+      const dir = this.optOutStoragePath.split('/').slice(0, -1).join('/');
+      await fs.mkdir(dir, { recursive: true });
+      await fs.writeFile(this.optOutStoragePath, JSON.stringify([...this.optedOutPhones], null, 2));
+    } catch (err) {
+      this.logger.error(`Failed to persist opt-out list: ${(err as Error).message}`);
+    }
   }
 }
diff --git a/src/properties/properties.module.ts b/src/properties/properties.module.ts
index 5bf7b652..0484eaae 100644
--- a/src/properties/properties.module.ts
+++ b/src/properties/properties.module.ts
@@ -14,11 +14,12 @@ import { NotificationsModule } from '../notifications/notifications.module';
 import { PropertiesResolver } from './properties.resolver';
 import { PubSub } from 'graphql-subscriptions';
 import { FraudModule } from '../fraud/fraud.module';
+import { DocumentsModule } from '../documents/documents.module';
 import { PropertyReportService } from './report/property-report.service';
 import { CacheModuleConfig } from '../cache/cache.module';
 
 @Module({
-  imports: [PrismaModule, AuthModule, FraudModule, ConfigModule, CacheModuleConfig, NotificationsModule],
+  imports: [PrismaModule, AuthModule, FraudModule, ConfigModule, CacheModuleConfig, DocumentsModule, NotificationsModule],
   controllers: [PropertiesController, PropertyImagesController],
   providers: [
     PropertiesService,
diff --git a/src/properties/property-images.service.ts b/src/properties/property-images.service.ts
index e0e635a6..9045cb84 100644
--- a/src/properties/property-images.service.ts
+++ b/src/properties/property-images.service.ts
@@ -15,6 +15,7 @@ import * as sharp from 'sharp';
 import { PrismaService } from '../database/prisma.service';
 import { PropertyImageResponse } from './dto/property-image.dto';
 import { DuplicateDetectionService } from '../duplicate-detection/duplicate-detection.service';
+import { DocumentUploadService } from '../documents/document-upload.service';
 
 /**
  * Minimal Multer file shape (we don't depend on @types/multer).
@@ -30,7 +31,12 @@ export interface UploadedImageFile {
 interface ImageVariantSpec {
   name: 'thumbnail' | 'medium' | 'full';
   width: number;
-  // Output quality (1-100). Lower for thumbnails to keep them small.
+  quality: number;
+}
+
+interface AvifVariantSpec {
+  name: 'thumbnail' | 'medium' | 'full';
+  width: number;
   quality: number;
 }
 
@@ -43,22 +49,25 @@ export class PropertyImagesService {
   private readonly publicPathPrefix = '/uploads/properties';
   private readonly maxFileSize: number;
   private readonly maxImagesPerProperty: number;
-  private readonly allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+  private readonly allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif'];
 
-  /**
-   * Variants emitted per uploaded image. All variants are converted to WebP for
-   * smaller file size and faster delivery (acceptance: optimization & thumbnails).
-   */
   private readonly variants: ImageVariantSpec[] = [
     { name: 'thumbnail', width: 300, quality: 70 },
     { name: 'medium', width: 800, quality: 78 },
     { name: 'full', width: 1920, quality: 82 },
   ];
 
+  private readonly avifVariants: AvifVariantSpec[] = [
+    { name: 'thumbnail', width: 300, quality: 60 },
+    { name: 'medium', width: 800, quality: 65 },
+    { name: 'full', width: 1920, quality: 70 },
+  ];
+
   constructor(
     private readonly prisma: PrismaService,
     private readonly configService: ConfigService,
     private readonly duplicateDetectionService: DuplicateDetectionService,
+    private readonly documentUploadService: DocumentUploadService,
   ) {
     this.uploadDir = this.configService.get<string>(
       'PROPERTY_IMAGES_UPLOAD_DIR',
@@ -67,7 +76,7 @@ export class PropertyImagesService {
     this.baseUrl = this.configService.get<string>('BASE_URL', 'http://localhost:3000');
     this.maxFileSize = this.configService.get<number>(
       'PROPERTY_IMAGE_MAX_SIZE',
-      10 * 1024 * 1024, // 10MB per file
+      10 * 1024 * 1024,
     );
     this.maxImagesPerProperty = this.configService.get<number>(
       'PROPERTY_IMAGE_MAX_PER_PROPERTY',
@@ -79,11 +88,6 @@ export class PropertyImagesService {
   // Public API
   // ---------------------------------------------------------------------------
 
-  /**
-   * Upload one or more images for a property.
-   * Each file is validated, optimized via sharp, written to disk in 3 variants,
-   * and persisted with a sequential `order` continuing after existing images.
-   */
   async uploadImages(
     propertyId: string,
     userId: string,
@@ -98,7 +102,20 @@ export class PropertyImagesService {
 
     files.forEach((f) => this.validateFile(f));
 
-    // Enforce per-property cap
+    for (const file of files) {
+      if (!this.documentUploadService.validateMagicBytes(file.buffer, file.mimetype)) {
+        throw new BadRequestException(
+          `File '${file.originalname}' magic bytes do not match declared type '${file.mimetype}'`,
+        );
+      }
+      const threat = this.documentUploadService.scanForThreats(file.buffer);
+      if (!threat.safe) {
+        throw new BadRequestException(
+          `File '${file.originalname}' failed threat scan: ${threat.reason}`,
+        );
+      }
+    }
+
     const existingCount = await this.prisma.propertyImage.count({
       where: { propertyId },
     });
@@ -108,7 +125,6 @@ export class PropertyImagesService {
       );
     }
 
-    // Duplicate image filename check (across all properties)
     for (const file of files) {
       const existingImage = await this.prisma.propertyImage.findFirst({
         where: { filename: file.originalname },
@@ -123,7 +139,6 @@ export class PropertyImagesService {
     const propertyDir = join(this.uploadDir, propertyId);
     await fs.mkdir(propertyDir, { recursive: true });
 
-    // Determine starting order and whether a primary already exists
     const last = await this.prisma.propertyImage.findFirst({
       where: { propertyId },
       orderBy: { order: 'desc' },
@@ -146,7 +161,6 @@ export class PropertyImagesService {
           propertyId,
           propertyDir,
           nextOrder,
-          // First uploaded image becomes primary if none exists yet
           !hasPrimary && i === 0,
         );
         created.push(processed);
@@ -155,7 +169,6 @@ export class PropertyImagesService {
         this.logger.error(
           `Failed to process image '${file.originalname}' for property ${propertyId}: ${(err as Error).message}`,
         );
-        // Continue with the rest; partial upload is acceptable
       }
     }
 
@@ -189,12 +202,10 @@ export class PropertyImagesService {
       throw new NotFoundException('Image not found');
     }
 
-    // Best-effort file removal (don't block DB delete on FS errors)
     await this.removeFilesForImage(propertyId, image.filename);
 
     await this.prisma.propertyImage.delete({ where: { id: imageId } });
 
-    // If the deleted image was primary, promote the next-ordered one
     if (image.isPrimary) {
       const next = await this.prisma.propertyImage.findFirst({
         where: { propertyId },
@@ -211,11 +222,6 @@ export class PropertyImagesService {
     return { deleted: true };
   }
 
-  /**
-   * Reorder by providing the full ordered list of image IDs.
-   * The DTO guarantees uniqueness; we additionally verify the IDs match
-   * exactly the property's images so callers can't smuggle foreign IDs.
-   */
   async reorderImages(
     propertyId: string,
     imageIds: string[],
@@ -283,6 +289,75 @@ export class PropertyImagesService {
     return this.toResponse(updated);
   }
 
+  // ---------------------------------------------------------------------------
+  // WebP/AVIF content negotiation
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Serve the best image variant based on the client's Accept header.
+   * Returns { buffer, contentType, cacheMaxAge }.
+   */
+  async serveOptimizedImage(
+    imageId: string,
+    acceptHeader: string,
+  ): Promise<{ buffer: Buffer; contentType: string; cacheMaxAge: number }> {
+    const image = await this.prisma.propertyImage.findUnique({ where: { id: imageId } });
+    if (!image) {
+      throw new NotFoundException('Image not found');
+    }
+
+    const propertyDir = join(this.uploadDir, image.propertyId);
+    const baseName = image.filename.replace(/\.\w+$/, '');
+
+    const acceptsAvif = acceptHeader.includes('image/avif');
+    const acceptsWebp = acceptHeader.includes('image/webp');
+
+    if (acceptsAvif) {
+      const avifPath = join(propertyDir, `full_${baseName}.avif`);
+      try {
+        const buffer = await fs.readFile(avifPath);
+        return { buffer, contentType: 'image/avif', cacheMaxAge: 86400 * 30 };
+      } catch {
+        // Generate AVIF on-the-fly from the full WebP variant
+        const webpPath = join(propertyDir, `full_${baseName}.webp`);
+        const webpBuffer = await fs.readFile(webpPath);
+        const avifBuffer = await this.generateAvifVariant(webpBuffer, { width: 1920, quality: 70 });
+        await fs.writeFile(avifPath, avifBuffer);
+        return { buffer: avifBuffer, contentType: 'image/avif', cacheMaxAge: 86400 * 30 };
+      }
+    }
+
+    if (acceptsWebp) {
+      const webpPath = join(propertyDir, `full_${baseName}.webp`);
+      try {
+        const buffer = await fs.readFile(webpPath);
+        return { buffer, contentType: 'image/webp', cacheMaxAge: 86400 * 7 };
+      } catch {
+        // fall through to original
+      }
+    }
+
+    // Fallback: serve original
+    const originalPath = join(propertyDir, image.filename);
+    const buffer = await fs.readFile(originalPath);
+    return { buffer, contentType: image.mimeType || 'application/octet-stream', cacheMaxAge: 3600 };
+  }
+
+  /**
+   * Generate an AVIF variant from a buffer.
+   */
+  async generateAvifVariant(
+    buffer: Buffer,
+    options: { width?: number; quality?: number } = {},
+  ): Promise<Buffer> {
+    const { width, quality = 70 } = options;
+    let pipeline = sharp(buffer).rotate();
+    if (width) {
+      pipeline = pipeline.resize({ width, withoutEnlargement: true });
+    }
+    return pipeline.avif({ quality }).toBuffer();
+  }
+
   // ---------------------------------------------------------------------------
   // Internals
   // ---------------------------------------------------------------------------
@@ -424,7 +499,6 @@ export class PropertyImagesService {
       const filename = `${variant.name}_${baseName}.webp`;
       const outPath = join(propertyDir, filename);
 
-      // Don't upscale: only resize if source is wider than the target.
       const targetWidth = meta.width && meta.width < variant.width ? meta.width : variant.width;
 
       const buffer = await sharp(file.buffer)
@@ -452,7 +526,22 @@ export class PropertyImagesService {
       }
     }
 
-    // Generate perceptual hash for duplicate detection
+    // Generate AVIF variants alongside WebP
+    for (const variant of this.avifVariants) {
+      const filename = `${variant.name}_${baseName}.avif`;
+      const outPath = join(propertyDir, filename);
+
+      const targetWidth = meta.width && meta.width < variant.width ? meta.width : variant.width;
+
+      const buffer = await sharp(file.buffer)
+        .rotate()
+        .resize({ width: targetWidth, withoutEnlargement: true })
+        .avif({ quality: variant.quality })
+        .toBuffer();
+
+      await fs.writeFile(outPath, buffer);
+    }
+
     const uniqueHash = this.generatePerceptualHash(file.buffer);
 
     const created = await this.prisma.propertyImage.create({
@@ -475,7 +564,7 @@ export class PropertyImagesService {
     });
 
     this.logger.log(
-      `Stored image ${baseName}.webp for property ${propertyId} ` +
+      `Stored image ${baseName}.webp (+ avif) for property ${propertyId} ` +
         `(order=${order}, primary=${isPrimary}, original=${file.size}B → optimized=${fullVariantSize}B, ` +
         `savings=${Math.round(((file.size - fullVariantSize) / file.size) * 100)}%)`,
     );
@@ -493,19 +582,24 @@ export class PropertyImagesService {
   }
 
   private async removeFilesForImage(propertyId: string, baseFilename: string): Promise<void> {
-    // baseFilename is `<base>.webp`; actual files are `<variant>_<base>.webp`.
-    const base = baseFilename.replace(/\.webp$/i, '');
+    const base = baseFilename.replace(/\.\w+$/i, '');
     const dir = join(this.uploadDir, propertyId);
 
+    const formats = ['webp', 'avif'];
+    const allVariants = [...this.variants, ...this.avifVariants];
+    const uniqueNames = [...new Set(allVariants.map((v) => v.name))];
+
     await Promise.all(
-      this.variants.map(async (v) => {
-        const path = join(dir, `${v.name}_${base}.webp`);
-        try {
-          await fs.unlink(path);
-        } catch {
-          // File may already be gone; ignore.
-        }
-      }),
+      formats.flatMap((fmt) =>
+        uniqueNames.map(async (name) => {
+          const path = join(dir, `${name}_${base}.${fmt}`);
+          try {
+            await fs.unlink(path);
+          } catch {
+            // File may already be gone; ignore.
+          }
+        }),
+      ),
     );
   }
 
diff --git a/test/cache/cache-stats.spec.ts b/test/cache/cache-stats.spec.ts
index 018f61d2..9017004b 100644
--- a/test/cache/cache-stats.spec.ts
+++ b/test/cache/cache-stats.spec.ts
@@ -54,9 +54,10 @@ describe('CacheStatsController', () => {
 describe('CacheHeadersInterceptor', () => {
   it('sets cache headers on response', (done) => {
     const interceptor = new CacheHeadersInterceptor();
-    const mockRes = { setHeader: jest.fn() };
+    const mockRes = { setHeader: jest.fn(), getHeader: jest.fn() };
+    const mockReq = { path: '/' };
     const ctx = {
-      switchToHttp: () => ({ getResponse: () => mockRes }),
+      switchToHttp: () => ({ getResponse: () => mockRes, getRequest: () => mockReq }),
     } as unknown as ExecutionContext;
     const next: CallHandler = { handle: () => of('data') };