Based on actual file analysis of sveden/abitur/vsoko modules: - html, css, js, map (content + assets) - png, jpg, gif, svg, ico, bmp (images) - ttf, woff, woff2, eot (fonts) - pdf, doc, docx (documents) - vikon (module-specific) No PHP/ASP/executables in allowed list — any non-whitelisted file is blocked.