Monday morning, I opened a client’s “price quote” image straight away
I was preparing a quote for a freelance photographer in Hangzhou when a WeChat message arrived with an image labeled “final price.” I double-clicked it, and the computer froze for more than ten seconds. It turned out to be an ordinary file, but my palms went cold. A harmless-looking image can still be an entry point for risk. I used to think only unfamiliar programs and suspicious links were dangerous. I got this wrong too. It reminded me that the biggest risk in a side gig isn’t some sophisticated attack; it’s my own habit of clicking “Open” without thinking.
I switched from “receiving an image” to “running a security check first”
This doesn’t depend on some magical tool. It adds a manual confirmation step: Is the source clear? Does the extension look normal? Can I preview the file in an isolated environment first? Security researcher Li Ning disclosed a high-severity vulnerability in 2026 involving a component related to Windows Paint. The affected versions and exploitation conditions need to be checked against the official advisory; not every Paint file is vulnerable. Still, the case gives us something worth remembering: ordinary images, documents, and installers all deserve a check, even when we’re only planning to take a quick look.
Replicating this today costs roughly $0 and 20 minutes
Money: $0. Windows Security Center and the system’s existing preview tools are enough for a basic check. Time: about 20 minutes. Technical barrier: low. No coding knowledge is needed—just the ability to save a file and check its type. First step: Open “Virus & threat protection” in Windows Security Center, choose “Scan options,” and run a “Custom scan.” Select the entire folder where the files arrived instead of double-clicking the image. After the scan, move the file into a separate temporary folder for viewing. Keep important files unchanged for now; don’t rename, forward, or send them to the client immediately. For online isolation checks, I can use a trusted virus-scanning site, but first I remove login credentials, identity documents, and client data from the file. Not everyone needs this routine. If I never receive files from strangers, or my work device has centralized company protection, my exposure is lower. There’s no urgency to try it today, but at least I can remember: scan first, open second.
I match the routine to the stage of my business
When I’m just starting: I set up one dedicated inbox for incoming files and scan it once a day. I don’t need to buy a service. When I have one or two clients: I store their assets in separate folders and keep the original sending records. If something looks wrong, I pause forwarding and contact the sender. When I’m scaling: I get colleagues to follow the same routine, then put software updates, permission management, and checks for contractor-provided files into our team agreement. I no longer upload every file to an online scanner. I run a basic check first, then decide whether uploading it is necessary. For us, security isn’t extra ceremony. It’s one fewer “I assumed it was fine.”