PromoSift never uploads images, executes image files, or intentionally stores absolute paths. Report vulnerabilities privately through GitHub Security Advisories. ZIP filenames are sanitized, but review exports before sharing. Do not attach sensitive captures to public issues.