added some security-related todos