updated TODO list with Xid protection