Safety design 

• Path traversal guards on every file operation: physical paths are resolved with realpath() and checked against the real storage base before any rename, unlink or read.
• Type-to-confirm on Delete all filtered in File Cleanup: the exact file count must be typed before it submits.
• ZIP backup download before deleting, in File Cleanup.
• Re-validation before flush: queued or scheduled flush runs re-check that the file still exists and is still safe to touch immediately before acting.
• Server-side deep check before every duplicate delete: the delete endpoint re-runs the full usage search and refuses when anything is found; admin only, POST only.
• Resize safeguards: dry run first, checks repeated on the real file at resize time, result discarded unless it saves at least 10 KB. No backup of the original (see Oversized images).
• Disk over database: duplicate report, oversized report and widgets check every file on disk and read sizes from disk instead of trusting sys_file.missing / sys_file.size .
• XSS-safe rendering: record titles and other user data from AJAX results are inserted with textContent only.
• Self-healing scans: if a stale DB flag no longer matches reality (a "missing" file is present again), the flag is corrected and the stale candidate dropped.