diff --git a/internal/apps/uploader/main.go b/internal/apps/uploader/main.go
index 6df68c0..a6c7f3a 100644
--- a/internal/apps/uploader/main.go
+++ b/internal/apps/uploader/main.go
@@ -1,24 +1,24 @@
 package uploader
 
 import (
-	"context"
-	"database/sql"
-	"embed"
-	"encoding/hex"
-	"encoding/json"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"time"
+    "context"
+    "database/sql"
+    "embed"
+    "encoding/hex"
+    "encoding/json"
+    "net/http"
+    "os"
+    "path/filepath"
+    "strconv"
+    "time"
 
-	"git.tijl.dev/tijl/tijl.dev-core/internal/config"
-	"git.tijl.dev/tijl/tijl.dev-core/internal/queries"
-	"git.tijl.dev/tijl/tijl.dev-core/internal/user"
-	"git.tijl.dev/tijl/tijl.dev-core/modules/db"
-	"git.tijl.dev/tijl/tijl.dev-core/modules/i18n"
-	"git.tijl.dev/tijl/tijl.dev-core/modules/web"
-	"github.com/gofiber/fiber/v2"
+    "git.tijl.dev/tijl/tijl.dev-core/internal/config"
+    "git.tijl.dev/tijl/tijl.dev-core/internal/queries"
+    "git.tijl.dev/tijl/tijl.dev-core/internal/user"
+    "git.tijl.dev/tijl/tijl.dev-core/modules/db"
+    "git.tijl.dev/tijl/tijl.dev-core/modules/i18n"
+    "git.tijl.dev/tijl/tijl.dev-core/modules/web"
+    "github.com/gofiber/fiber/v2"
 )
 
 //go:embed locales/*
@@ -32,6 +32,10 @@ func Setup() {
 
     web.RegisterAppSetupFunc(func(a *fiber.App) {
         a.Get("/app/uploader", func(c *fiber.Ctx) error {
+            _, err := user.GetSession(c)
+            if err != nil {
+                return c.Redirect("/auth?redirect=/app/uploader", http.StatusUnauthorized)
+            }
             data := *web.Common(c)
             data["Title"] = "tmp"
             return c.Render("apps/uploader/index", data, "layouts/base")
@@ -39,7 +43,7 @@ func Setup() {
         a.Get("/app/uploader/:key", func(c *fiber.Ctx) error {
             encryptionKey, err := hex.DecodeString(c.Params("key"))
             if err != nil {
-                return err
+                return c.Next()
             }
             storageKey := hashKey(encryptionKey)
 
@@ -57,7 +61,7 @@ func Setup() {
                 return err
             }
 
-            if accessCount >= int64(row.MaxVisits) {
+            if accessCount == int64(row.MaxVisits) || accessCount > int64(row.MaxVisits) {
                 return c.Next()
             }
 
@@ -115,10 +119,10 @@ func Setup() {
                 return c.SendStatus(http.StatusUnauthorized)
             }
 
-           expireDays, err := strconv.Atoi(c.FormValue("expire_days"))
-           if err != nil {return err}
+            expireDays, err := strconv.Atoi(c.FormValue("expire_days"))
+            if err != nil {return err}
             maxDownloads, err := strconv.Atoi(c.FormValue("max_downloads"))
-           if err != nil {return err}
+            if err != nil {return err}
 
             file, err := c.FormFile("file")
             if err != nil {
diff --git a/web/views/apps/flags/start.html b/web/views/apps/flags/start.html
index 841cbc8..86cf705 100644
--- a/web/views/apps/flags/start.html
+++ b/web/views/apps/flags/start.html
@@ -1,8 +1,8 @@
 <div hx-boost="true"> <div id="error-message" class="text-red-500 mb-4"></div> 
     <form method="post" hx-on="htmx:responseError:
         document.getElementById('error-message').innerHTML = '{{.T.error_long}}: 
-            ' + event.detail.xhr.responseText; htmx.trigger(this, 'htmx:swap', { 
-            target: '#error-message', swap: 'innerHTML' });">
+        ' + event.detail.xhr.responseText; htmx.trigger(this, 'htmx:swap', { 
+        target: '#error-message', swap: 'innerHTML' });">
         <input type="text" class="hidden" name="type" value="start" />
 
         <div> {{range .SupportedTags}} <label class="cursor-pointer label">
@@ -12,29 +12,29 @@
             </label> {{end}}
         </div>
 
-{{if .SignedIn}}
+        {{if .SignedIn}}
         <label class="cursor-pointer label mt-5"> <span 
-            class="label-text">Share</span> <input name="share" type="checkbox" 
+                class="label-text">Share</span> <input name="share" type="checkbox" 
             class="checkbox checkbox-primary" />
         </label>
-{{end}}
+        {{end}}
 
         <div> <label>
                 <span>max questions</span> <input value="0" placeholder="max 
                 questions" name="max_questions" type="number"
-                    class="input input-bordered" /> </label>
+                class="input input-bordered" /> </label>
         </div>
 
         <div> <label>
                 <span>time limit</span> <input value="0" placeholder="seconds 
                 time limit" name="seconds" type="number"
-                    class="input input-bordered" /> </label>
+                class="input input-bordered" /> </label>
         </div>
 
         <button type="submit" class="btn btn-primary">Submit</button> </form>
     <form class="mt-4" method="post"> <input type="text" class="hidden" 
         name="type" value="shared" /> <input type="text" class="input 
         input-bordered" name="sharekey" placeholder="sharekey" /> <button 
-        type="submit" class="btn btn-primary">Shared</button>
+            type="submit" class="btn btn-primary">Shared</button>
     </form>
 </div>