diff --git a/backend/handlers/portfolio/images.go b/backend/handlers/portfolio/images.go
index 29d7810..a1e8fe7 100644
--- a/backend/handlers/portfolio/images.go
+++ b/backend/handlers/portfolio/images.go
@@ -11,6 +11,7 @@ import (
 	"crussell/mw"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -705,8 +706,15 @@ func UploadImage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	//nolint:errcheck // parse errors are non-fatal; form values may still be available
-	_ = r.ParseMultipartForm(50 << 20)
+	if err := r.ParseMultipartForm(10 << 20); err != nil {
+		var maxBytesErr *http.MaxBytesError
+		if errors.As(err, &maxBytesErr) {
+			http.Error(w, "Upload too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		// Non-size parse errors: log but continue — form values (tags) may be available
+		log.Printf("Warning: ParseMultipartForm: %v", err)
+	}
 
 	tagsStr := r.FormValue("tags")
 	tags := []string{}
diff --git a/backend/handlers/user/profile.go b/backend/handlers/user/profile.go
index 8d0e025..23715cf 100644
--- a/backend/handlers/user/profile.go
+++ b/backend/handlers/user/profile.go
@@ -1002,8 +1002,15 @@ func UploadProfilePictureHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	//nolint:errcheck // parse errors are non-fatal; form values may still be available
-	_ = r.ParseMultipartForm(10 << 20)
+	if err := r.ParseMultipartForm(1 << 20); err != nil {
+		var maxBytesErr *http.MaxBytesError
+		if errors.As(err, &maxBytesErr) {
+			http.Error(w, "Profile picture too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		// Non-size parse errors: log but continue — form values may still be available
+		log.Printf("Warning: ParseMultipartForm: %v", err)
+	}
 
 	file, _, err := r.FormFile("file")
 	if err != nil {