diff --git a/server/upload.php b/server/upload.php
index 1f0944c..d8a371c 100644
--- a/server/upload.php
+++ b/server/upload.php
@@ -1,2 +1,3 @@
 // TODO when uploading, generate and send back Guid and store in meta file
 // TODO when uploading, also generate and return a deletion password that is stored in meta file
+// TODO figure out some way to make the meta file "hidden" to the web server - maybe subfolder with denied access in apache?