They wouldn't trust the sender they would assign a dev to inspect the referenced file, decision making would start at that point.