diff --git a/data/.gitignore b/data/.gitignore
index f59ec20..f2c4ee5 100644
--- a/data/.gitignore
+++ b/data/.gitignore
@@ -1 +1 @@
-*
\ No newline at end of file
+*.*
diff --git a/data/projects/.gitignore b/data/projects/.gitignore
new file mode 100644
index 0000000..72e8ffc
--- /dev/null
+++ b/data/projects/.gitignore
@@ -0,0 +1 @@
+*
diff --git a/package.json b/package.json
index 2a454ae..1694774 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,7 @@
     "start": "node app"
   },
   "dependencies": {
-    "express": "3.1.0"
+    "express": "3.1.0",
+    "lodash": "*"
   }
 }
\ No newline at end of file
diff --git a/pikachu.js b/pikachu.js
index 6c0968e..a5fcee2 100644
--- a/pikachu.js
+++ b/pikachu.js
@@ -6,7 +6,8 @@
 var express = require('express'),
   http = require('http'),
   path = require('path'),
-  fs = require('fs');
+  fs = require('fs'),
+  _ = require('lodash');
 
 var app = express();
 
@@ -41,7 +42,8 @@ app.get('/', function (req, res) {
     if (err) {
       res.send(500, JSON.stringify(err));
     } else {
-      res.send(JSON.stringify(files));
+      var nonHiddenFiles = _.filter(files, function(file) { return !isUnixHiddenPath(file); });
+      res.send(JSON.stringify(nonHiddenFiles));
     }
   });
 });
@@ -66,6 +68,58 @@ app.post('/', function (req, res) {
   });
 });
 
+app.get('/projects', function (req, res) {
+  fs.readdir(path.join(DATA_DIR, 'projects'), function (err, files) {
+    res.type('json');
+
+    if (err) {
+      res.send(500, JSON.stringify(err));
+    } else {
+      var nonHiddenFiles = _.filter(files, function(file) { return !isUnixHiddenPath(file); });
+      res.send(JSON.stringify(nonHiddenFiles));
+    }
+  });
+});
+
+app.get('/projects/:name', function (req, res) {
+  var folder = req.params.name;
+  fs.readdir(path.join(DATA_DIR, 'projects', folder), function (err, files) {
+    res.type('json');
+
+    if (err) {
+      res.send(500, JSON.stringify(err));
+    } else {
+      res.send(JSON.stringify(files));
+    }
+  });
+
+});
+
+app.post('/projects/:name', function (req, res) {
+  var folder = req.params.name;
+  var storage_folder = path.join(DATA_DIR, 'projects', folder);
+  if (!fs.existsSync(storage_folder)) {
+    fs.mkdirSync(storage_folder);
+  }
+  fs.readdir(storage_folder, function (err, files) {
+    var newId = Math.random() * 9007199254740992; // max int value, see http://stackoverflow.com/questions/307179/what-is-javascripts-max-int-whats-the-highest-integer-value-a-number-can-go-t
+    var newFilename = newId.toString(36) + path.extname(req.files.file.filename);
+    fs.rename(req.files.file.path, path.join(storage_folder, newFilename), function (err) {
+      res.type('json');
+      if (err) {
+        res.send(500, JSON.stringify(err));
+      } else {
+        var f = {
+          url: newFilename,
+          size: req.files.file.size,
+          type: req.files.file.type
+        }
+        res.send(JSON.stringify(f));
+      }
+    });
+  });
+});
+
 http.createServer(app).listen(app.get('port'), function(){
   console.log("Express server listening on port " + app.get('port'));
 });
@@ -96,3 +150,13 @@ function cors(req, res, next) {
         next();
     }
 }
+
+/**
+ * Checks whether a path starts with or contains a hidden file or a folder.
+ * @param {string} source - The path of the file that needs to be validated.
+ * returns {boolean} - `true` if the source is blacklisted and otherwise `false`.
+ * via http://stackoverflow.com/questions/8905680/nodejs-check-for-hidden-files
+ */
+var isUnixHiddenPath = function (path) {
+    return (/(^|.\/)\.+[^\/\.]/g).test(path);
+};