(incomplete) Secure Design Pattern - Upload