Seems like it would be a good idea to add crossorigin="anonymous" referrerpolicy="origin" attributes to user-provided images. This would prevent any 3rd party tracking or referrer leaking.