diff --git a/SECURITY.md b/SECURITY.md
index c596e676c..7283fe0e2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,6 +6,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 # Security Policy
 
+CryptPad security policy is detailed in the following document: https://cryptpad.org/security/.
+
 ## Supported Versions
 
 Considering the amount of resources necessary to backport security or bug fixes to previous, unsupported CryptPad versions, it's not something we do.
@@ -13,7 +15,7 @@ However, we quickly release new minor versions in case of need.
 
 Please keep up with the latest release published here: https://github.com/cryptpad/cryptpad/releases
 
-Note that every GitHub release page has an RSS compatible feed that you can subscribe on to be informed of every new release.
+Note that every GitHub release page has an [RSS compatible feed](https://github.com/cryptpad/cryptpad/releases.atom) that you can subscribe on to be informed of every new release.
 
 We do also communicate about this topic on:
 - [Our blog](https://blog.cryptpad.org)
diff --git a/lib/storage/blob.js b/lib/storage/blob.js
index fd25d638d..5ad2dd8db 100644
--- a/lib/storage/blob.js
+++ b/lib/storage/blob.js
@@ -664,6 +664,8 @@ var listBlobs = function (root, handler, fast, cb) {
                 var nestedDirPath = Path.join(root, dir);
                 Fs.readdir(nestedDirPath, w(function (err, list) {
                     if (err) { return void handler(err); } // Is this correct?
+
+                    const s = new Set(list);
                     list.forEach(function (item) {
                         // ignore hidden files
                         if (/^\./.test(item)) { return; }
@@ -677,7 +679,7 @@ var listBlobs = function (root, handler, fast, cb) {
                         if (!/^[0-9a-fA-F]{48}$/.test(item)) {
                             blobName = item.replace(/\.metadata\.ndjson/, '');
                             // check if blob already exists
-                            if (list.indexOf(blobName) !== -1) { return; }
+                            if (s.has(blobName)) { return; }
                             // otherwise set a flag indicating that we should
                             // handle the metadata on its own
                             isLonelyMetadata = true;
diff --git a/lib/storage/file.js b/lib/storage/file.js
index 1b3995fe1..032f2a36d 100644
--- a/lib/storage/file.js
+++ b/lib/storage/file.js
@@ -790,6 +790,7 @@ var listChannels = function (root, handler, cb, fast) {
                 Fs.readdir(nestedDirPath, w(function (err, list) {
                     if (err) { return void handler(err); } // Is this correct?
 
+                    const s = new Set(list);
                     list.forEach(function (item) {
                         // ignore hidden files
                         if (/^\./.test(item)) { return; }
@@ -808,7 +809,7 @@ var listChannels = function (root, handler, cb, fast) {
 
                             // if there is a corresponding channel present in the list,
                             // then we should stop here and handle everything when we get to the channel
-                            if (list.indexOf(channelName) !== -1) { return; }
+                            if (s.has(channelName)) { return; }
                             // otherwise set a flag indicating that we should
                             // handle the metadata on its own
                             isLonelyMetadata = true;