No TODO or FIXME comments in critical business logic

A TODO: add auth check here comment in authentication code means the auth check is absent — not planned, not partially implemented, but missing. This is a shipped security gap with a note attached. In payment processing code, FIXME: validate webhook signature means webhook validation is not happening. ISO 25010 maintainability.analysability penalizes TODOs that represent real functionality gaps, not just cleanup debt. At 10+ total TODOs, the project signals that a substantial portion of intended functionality was deferred without resolution.

For each TODO found in authentication, authorization, payment, or validation code: implement the missing control before shipping. For TODOs tracked in an issue tracker, replace the comment with the issue URL:

// TODO: rate limiting - https://github.com/org/repo/issues/42

For resolved TODOs, delete the comment. Add an ESLint rule to warn on TODO comments in committed code:

"no-warning-comments": ["warn", { "terms": ["TODO", "FIXME", "HACK", "XXX"] }]

For pre-launch readiness covering deferred feature gaps more broadly, the Pre-Launch Readiness Audit addresses this in detail.