What sets the vnd. tree apart from the standard tree in RFC 6838?
The standard tree (no prefix) is for general-purpose types registered by the IETF or by broad consensus, like text/html. The vnd. tree is for proprietary formats registered by a specific company or project, like application/vnd.ms-excel; any organisation can register its own vnd. subtype without needing a full IETF standard.
Does the JSON Content-Type need the charset parameter?
It is not required. RFC 8259 mandates UTF-8 encoding for JSON by default, which makes application/json; charset=utf-8 redundant in practice, though harmless. text/html and other textual types with no fixed encoding standard still benefit from an explicit charset to stop the browser from guessing wrong.
What exactly does X-Content-Type-Options: nosniff block?
It stops the browser from ignoring the declared Content-Type and trying to guess the real type from the file content, a behaviour called MIME sniffing that older browsers used to tolerate misconfigured servers. Without nosniff, a malicious upload disguised as an image can be executed as a script if its content looks like HTML.