adds TODO comments for security, config, and cleanup