Depending on your server-configuration, your photos were listed inside the upload-directory. This security-flaw is now fixed. Thanks @GustavePate for the notice.
@@ -0,0 +1 @@
+IndexIgnore *
Tobias Reich