Add TODO secure coding re: file name persistence