Articles · Pillar guide
Pre-send file checklist: metadata, secrets, and QR risks
Most leaks are boring: a resume with an old phone number in properties, a log with an API key, a “harmless” QR that opens a phishing URL, a share link forwarded too widely. A short pre-send checklist beats a long apology. This pillar is the habit; DevNestro’s inspectors are the spot checks.
The problem
People proofread the visible paragraphs and ignore everything else. File names contain client codes. PDFs remember authors. Photos remember GPS. Screenshots remember tokens in the address bar. QR stickers and slides encode URLs nobody reads. Temporary share links feel private until they are pasted into a group chat. The common thread is skipping a deliberate pause before Send.
How it works
Walk the file as an attacker with one minute on the clock. Check visible content, then metadata, then embedded codes, then the transport (email attachment vs expiring link). Use browser-local scanners when you can. For text destined for an AI chat, run a prompt privacy pass first. For camera photos, strip EXIF. For PDFs, check document properties and redaction quality. For QR images, decode before you print or forward. Only then choose how to deliver the file.
Practical steps
- Visible content: search for emails, account IDs, internal hostnames, and secrets you would not put on a postcard.
- Metadata: photos (GPS), PDFs (author/title), office exports — clean or rebuild if needed.
- Pixels: redact screenshots; do not rely on highlighter overlays.
- QR and links: decode the code; open only if the destination is expected.
- Transport: prefer expiring links you control for large files; do not upload malware or material you lack rights to share.
Privacy and trust
Safe-to-Share File Inspector, Photo Metadata Cleaner, Document Privacy Cleaner, Privacy Redactor, Prompt Privacy Checker, and QR Safety Inspector run in your browser on DevNestro. File Share stores one file on this web app’s disk for 24 hours by design — use it only for material you may distribute, and read the acceptable-use notes.
Pitfalls
A green check from any single tool is not a legal clearance. Pattern scanners miss novel secrets. QR decoders do not prove a site is honest — only what URL is encoded. Expiring links can still be copied during their lifetime. Do not send regulated data through consumer tools without your own compliance review.
Questions people ask
What should I check first on a screenshot?
Pixels: names, emails, tokens, and URLs. Then ask whether you should send a screenshot at all versus a redacted crop.
Is File Share private?
It is an unlisted expiring download, not end-to-end encryption for the recipient’s eyeballs. Anyone with the link can fetch while it lives.
Can QR codes steal data just by scanning?
A scan typically opens a URL or shows text. The risk is the destination (phishing, malware download), not magic theft from your camera alone.
What if I already hit Send?
Rotate exposed secrets, ask the recipient to delete, and treat the copy as public. Prevention is cheaper.
Pause before Send. Run Safe-to-Share or the matching cleaner, then deliver only the file you would accept if it were forwarded.