What identifies a source
The author field of a document. The camera serial number in a photograph, which links every image that body ever produced. The GPS coordinates of a picture taken inside a building. A printer's identification pattern in a scan. The username embedded in a file path inside an office document.
Published files carry it onward
Uploading a leaked document to your own site republishes its metadata to the world. The safe practice is to transcribe or re-render the content rather than publish the original file, and to verify the replacement independently.
Instruct sources before they send
By the time a file reaches you, the exposure has already happened, and it may be logged somewhere in transit. Guidance to sources is worth more than any cleaning done at your end: photograph a screen rather than screenshot it, retype rather than forward, avoid the original file where the content can be conveyed without it.
Verification cuts the other way
The same metadata that endangers a source can authenticate a document. Strip it for publication, but consider what you need to retain privately, and separate those decisions deliberately.