Pretty straight forward question, but I'll provide any clarifications needed.
The reason I'm asking is this: I created a child theme that pulls in a
custom-functions.php file. This allows devs to customize the site without editing the child theme. I know that's the purpose of a child theme, but for the sake of brevity I won't go into the reasoning behind all that.
/wp-content/uploads/customizations. Is this a security risk? And if so, what's a better place to put it. I don't want to put it in my child theme because it'll get overwritten when the theme is updated.