savepath reads metadata with the running user's permissions and never writes. If you find a way it exposes data a user should not see, report it privately via GitHub security advisories.