diff --git a/Controller/ApiController.php b/Controller/ApiController.php
index adfaab2..62b4188 100755
--- a/Controller/ApiController.php
+++ b/Controller/ApiController.php
@@ -65,6 +65,22 @@ use phpOMS\Views\View;
  * @license OMS License 2.0
  * @link    https://jingga.app
  * @since   1.0.0
+ *
+ * @feature Allow PDF modification (allow notes on PDF, approval stamps)
+ *      This requires a JS live preview for adding this at a specific position (maybe PDFJSAnnotate, maybe customize PDF.js)
+ *      https://github.com/Karaka-Management/oms-Billing/issues/11
+ *
+ * @feature Job/Schedule which checks unhandled invoices
+ *      https://github.com/Karaka-Management/oms-Billing/issues/10
+ *
+ * @feature Allow to index a local file if it is not in the database
+ *      E.g. button with text "Add to Application"
+ *      Un-indexed files cannot be changed/moved/deleted.
+ *      https://github.com/Karaka-Management/oms-Media/issues/18
+ *
+ * @feature Create preview option for images
+ *      E.g. ctrl+mouse hover or a different "list-view" like in explorer
+ *      https://github.com/Karaka-Management/oms-Media/issues/19
  */
 final class ApiController extends Controller
 {
@@ -358,6 +374,10 @@ final class ApiController extends Controller
 
         $created = [];
         foreach ($status as &$stat) {
+            if (!Guard::isSafeFile($stat['path'] . '/' . $stat['filename'])) {
+                continue;
+            }
+
             ++$nCounter;
 
             // Possible: name != filename (name = database media name, filename = name on the file system)
@@ -387,6 +407,10 @@ final class ApiController extends Controller
             $created[] = $media;
         }
 
+        if (empty($created)) {
+            return new NullCollection();
+        }
+
         if (!$createCollection) {
             $collection          = new NullCollection();
             $collection->sources = $created;
diff --git a/Models/Media.php b/Models/Media.php
index 1b4495e..bab42a5 100755
--- a/Models/Media.php
+++ b/Models/Media.php
@@ -236,7 +236,11 @@ class Media implements \JsonSerializable
      */
     public function encrypt(string $key, ?string $outputPath = null) : bool
     {
-        return EncryptionHelper::encryptFile($this->getAbsolutePath(), $outputPath ?? $this->getAbsolutePath(), $key);
+        return EncryptionHelper::encryptFile(
+            $this->getAbsolutePath(),
+            $outputPath ?? $this->getAbsolutePath(),
+            $key
+        );
     }
 
     /**
@@ -251,7 +255,11 @@ class Media implements \JsonSerializable
      */
     public function decrypt(string $key, ?string $outputPath = null) : bool
     {
-        return EncryptionHelper::decryptFile($this->getAbsolutePath(), $outputPath ?? $this->getAbsolutePath(), $key);
+        return EncryptionHelper::decryptFile(
+            $this->getAbsolutePath(),
+            $outputPath ?? $this->getAbsolutePath(),
+            $key
+        );
     }
 
     /**
diff --git a/Models/UploadFile.php b/Models/UploadFile.php
index 6268ec8..a520482 100755
--- a/Models/UploadFile.php
+++ b/Models/UploadFile.php
@@ -190,7 +190,7 @@ class UploadFile
             }
 
             if (!\is_dir($path) && !Directory::create($path, 0755, true)) {
-                FileLogger::getInstance()->error('Couldn\t upload media file. There maybe is a problem with your permission or uploaded file.');
+                FileLogger::getInstance()->error('Couldn\'t upload media file. There maybe is a problem with your permission or uploaded file.');
             }
 
             if (!\rename($f['tmp_name'], $dest = $path . '/' . $result[$key]['filename'])) {
@@ -199,6 +199,11 @@ class UploadFile
                 return $result;
             }
 
+            // Make sure uploaded file is not executable
+            $currentPermissions = \fileperms($dest);
+            $newPermissions = $currentPermissions & ~0100;
+            \chmod($dest, $newPermissions);
+
             if ($encryptionKey !== '') {
                 $isEncrypted = EncryptionHelper::encryptFile($dest, $dest, $encryptionKey);
 
@@ -218,6 +223,8 @@ class UploadFile
             /*
             if ($encoding !== '') {
                 // changing encoding bugs out image files
+                // @todo Automatically change the file encoding of text files
+                //      https://github.com/Karaka-Management/oms-Media/issues/21
                 //FileUtils::changeFileEncoding($dest, $encoding);
             }*/
 
diff --git a/Theme/Backend/Components/Media/list.tpl.php b/Theme/Backend/Components/Media/list.tpl.php
index 7a3443d..616650b 100755
--- a/Theme/Backend/Components/Media/list.tpl.php
+++ b/Theme/Backend/Components/Media/list.tpl.php
@@ -12,6 +12,7 @@
  */
 declare(strict_types=1);
 
+use phpOMS\System\File\ExtensionType;
 use phpOMS\System\File\FileUtils;
 use phpOMS\Uri\UriFactory;
 
@@ -44,7 +45,8 @@ $next = empty($this->media)
                 $extensionType = FileUtils::getExtensionType($value->extension);
                 $icon          = $fileIconFunction($extensionType);
         ?>
-        <tr data-href="<?= $url; ?>">
+        <tr data-href="<?= $url; ?>"
+            <?= \in_array($extensionType, [ExtensionType::IMAGE, ExtensionType::PDF]) ? 'data-preview="' . UriFactory::build('{/api}media/export?id=' . $value->id . '&type=html&csrf={$CSRF}') . '"' : ''; ?>>
             <td data-label="<?= $this->getHtml('Type'); ?>"><a href="<?= $url; ?>"><i class="g-icon"><?= $this->printHtml($icon); ?></i></a>
             <td data-label="<?= $this->getHtml('Path'); ?>"><a class="content" href="<?= UriFactory::build('{/base}/media/list?{?}&path=' . $value->getVirtualPath()); ?>"><?= $this->printHtml($value->getVirtualPath()); ?></a>
             <td data-label="<?= $this->getHtml('Name'); ?>"><a href="<?= $url; ?>"><?= $this->printHtml($value->name); ?></a>
diff --git a/Theme/Backend/media-list.tpl.php b/Theme/Backend/media-list.tpl.php
index 7bddb4f..52f2f69 100755
--- a/Theme/Backend/media-list.tpl.php
+++ b/Theme/Backend/media-list.tpl.php
@@ -12,6 +12,7 @@
  */
 declare(strict_types=1);
 
+use phpOMS\System\File\ExtensionType;
 use phpOMS\System\File\FileUtils;
 use phpOMS\Uri\UriFactory;
 use phpOMS\Utils\Converter\FileSizeType;
@@ -184,22 +185,24 @@ $next     = empty($media) ? '{/base}/media/list' : '{/base}/media/list?{?}&offse
                             <td>
                     <?php endif; ?>
                     <?php $count = 0;
-                        foreach ($media as $key => $value) :
-                            ++$count;
+                    foreach ($media as $key => $value) :
+                        ++$count;
 
-                            $url = $value->extension === 'collection'
-                                ? UriFactory::build('{/base}/media/list?path=' . \rtrim($value->getVirtualPath(), '/') . '/' . $value->name)
-                                : UriFactory::build('{/base}/media/view?id=' . $value->id
-                                    . '&path={?path}' . (
-                                            $value->id === 0
-                                                ? '/' . $value->name
-                                                : ''
-                                        )
-                                );
+                        $url = $value->extension === 'collection'
+                            ? UriFactory::build('{/base}/media/list?path=' . \rtrim($value->getVirtualPath(), '/') . '/' . $value->name)
+                            : UriFactory::build('{/base}/media/view?id=' . $value->id
+                                . '&path={?path}' . (
+                                        $value->id === 0
+                                            ? '/' . $value->name
+                                            : ''
+                                    )
+                            );
 
-                            $icon = $fileIconFunction(FileUtils::getExtensionType($value->extension));
-                        ?>
-                    <tr tabindex="0" data-href="<?= $url; ?>">
+                        $icon = $fileIconFunction($extensionType = FileUtils::getExtensionType($value->extension));
+                    ?>
+                    <tr tabindex="0"
+                        data-href="<?= $url; ?>"
+                        <?= \in_array($extensionType, [ExtensionType::IMAGE, ExtensionType::PDF]) ? 'data-preview="' . UriFactory::build('{/api}media/export?id=' . $value->id . '&type=html&csrf={$CSRF}') . '"' : ''; ?>>
                         <td><label class="checkbox" for="iMediaSelect-<?= $key; ?>">
                                 <input type="checkbox" id="iMediaSelect-<?= $key; ?>" name="mediaselect">
                                 <span class="checkmark"></span>