diff --git a/README.md b/README.md
index 4ca4ce6..2d6689a 100644
--- a/README.md
+++ b/README.md
@@ -63,6 +63,7 @@ On the admin panel you can check the logs and the secrets for gsocket access.
 <img src="https://github.com/elleoma/facinus/blob/beta/screenshots/admin.png"/>
 
 ## TODO
+- [ ] fix path traversal vulnerability
 - [ ] Do fake poweroff for all possible variants for Ubuntu/Debian with gnome.
 - [x] Add checks for other distros
 - [ ] Obfuscation, process hiding, etc.