Check what arrived
A filename ending in .png proves little. Restrict accepted formats, inspect file signatures and enforce size limits before processing.
Save a controlled image
Decode and rewrite accepted images. Generate storage names on the server and keep uploads outside a directory that executes application code.
Separate uploading from publishing
A successful upload should not automatically expose a draft screenshot. In a portfolio, let the administrator preview it first and publish the project deliberately.