diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..e99b5fd
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,6 @@
+- url unescaping (uriparser? libcurl?)
+- parse request headers (ie Authentication)
+- threading or async
+- optional allowlist of available paths (throw something else on unavailable ones)
+- denylist of known-bad url strings
+- fix memory issues or use a GC (bdwgc probably)
diff --git a/bin/httpsrv b/bin/httpsrv
index 4ec24e4..abbe841 100755
Binary files a/bin/httpsrv and b/bin/httpsrv differ
diff --git a/lib/file.h b/lib/file.h
index 30c0599..848ade6 100644
--- a/lib/file.h
+++ b/lib/file.h
@@ -27,5 +27,6 @@ char* readFile(char* path) {
 	buf[length] = '\0';
 
 	char* tmp = buf;
+	free(buf);
 	return tmp;
 }
diff --git a/lib/log.h b/lib/log.h
index 1bbc3b3..0ada7e9 100644
--- a/lib/log.h
+++ b/lib/log.h
@@ -14,6 +14,7 @@ void info(char* ustr, ...) {
 	va_list lst;
 	va_start(lst, ustr);
 	vprintf(str, lst);
+	free(str);
 }
 
 void warn(char* ustr, ...) {
@@ -24,6 +25,7 @@ void warn(char* ustr, ...) {
 	va_list lst;
 	va_start(lst, ustr);
 	vprintf(str, lst);
+	free(str);
 }
 
 void error(char* ustr, ...) {
@@ -34,6 +36,7 @@ void error(char* ustr, ...) {
 	va_list lst;
 	va_start(lst, ustr);
 	vprintf(str, lst);
+	free(str);
 }
 
 void reqlog(char* ustr, ...) {
@@ -44,4 +47,5 @@ void reqlog(char* ustr, ...) {
 	va_list lst;
 	va_start(lst, ustr);
 	vprintf(str, lst);
+	free(str);
 }
diff --git a/src/srv.c b/src/srv.c
index f0a9f2c..d5f4204 100644
--- a/src/srv.c
+++ b/src/srv.c
@@ -14,7 +14,6 @@
 #include "log.h"
 
 int srv(char* ADDR, int PORT) {
-	char buffer[BUFSIZ];
 	int srvSocket;
 	struct sockaddr_in srvAddr;
 
@@ -98,6 +97,7 @@ funy: {
 		sprintf(resHeader, "%s%s", (char*)tmpHeader, file);
 		send(client, resHeader, strlen(resHeader), 0);
 		close(client);
+		free(resHeader);
 	}
 	}
 }