diff --git a/src/main/kotlin/core/node/services/NodeAttachmentService.kt b/src/main/kotlin/core/node/services/NodeAttachmentService.kt
index 67128f5390..c5421a258b 100644
--- a/src/main/kotlin/core/node/services/NodeAttachmentService.kt
+++ b/src/main/kotlin/core/node/services/NodeAttachmentService.kt
@@ -101,6 +101,7 @@ class NodeAttachmentService(val storePath: Path, val metrics: MetricRegistry) :
         return AttachmentImpl(id, path, checkAttachmentsOnLoad)
     }
 
+    // TODO: PLT-147: The attachment should be randomised to prevent brute force guessing and thus privacy leaks.
     override fun importAttachment(jar: InputStream): SecureHash {
         require(jar !is JarInputStream)
         val hs = HashingInputStream(Hashing.sha256(), jar)