What stays inside a JPEG you commit
A phone photo in a repo is not only pixels. The JPEG often still holds a capture time, a GPS point, and the camera or app name. Exports from newer editors may also keep a content-credential block. Git stores the file as it was added, and a public repository serves that same file to anyone who clones it.
Resizing in an image pipeline does not always clear those fields. Some CDNs read the orientation tag and rotate the bitmap. Others ignore it, so the picture looks sideways only in production. Strip or bake the orientation on a copy before the file is committed. Leave the camera-roll original outside the repo.
On that copy, drop the location and any credential block you do not mean to publish. I run the file through this free browser tool, then commit the cleaned version and check it once with a metadata reader.
If the reader still shows GPS or a credential manifest, the wrong file went in. Replace it before the push.