1. The scan boundary must be visible
A good tool shows the current scan locations and refuses system, application and other high-risk directories. A generic scanning message does not let the user recognize when scope has expanded unexpectedly.
Start with one folder whose purpose is clear. Scanning an entire drive mixes personal data with projects, backups and application resources; wider is not automatically safer or more complete.
2. Keeper rules must survive bulk selection
Every duplicate group needs at least one protected item that bulk selection cannot override. Switching to an irreversible mode should also clear automatic selections.
An earlier creation time or shorter path can be a suggestion, not proof of origin. Folder purpose and explicit protection rules must take priority over timestamp ordering.
3–5. Recovery, revalidation and complete records
The default action should use the Recycle Bin. A failed trash operation must never silently fall back to permanent deletion; the two execution paths need separate consent and code paths.
Files can change between scanning and action. Recheck path, size, time and content state immediately beforehand, skip changed items, and record every success or failure with its reason.
- Recycle Bin is the default
- Permanent deletion has a separate warning
- Changed files are skipped
- Every result has an audit record
6. Privacy claims need technical boundaries
A local-analysis claim should explain what leaves the device, whether third-party scripts load and whether the page has write access. A broad security slogan is not a substitute for a verifiable boundary.
Open source makes inspection possible but does not automatically guarantee safety. Check the exact release, build source, updater and permissions, then test the complete workflow with disposable data.