Max file size: configured by server (PHP default upload_max_filesize). For security, only allow trusted users to upload.