--- a/TODO.txt	Wed Nov 03 09:49:14 2004 +0000
+++ b/TODO.txt	Wed Nov 03 21:12:35 2004 +0000
@@ -6,9 +6,9 @@
 - fix documentation referring to customisation using interfaces.py
 - fix admin_guide referring to structure of trackers
 - add config.ini section descriptions - DONE?
-- review use of hasPermission etc. in classic template (check all uses,
-  make sure they're appropriate, make sure anonymous has a reasonable view
-  of things by default)
+- Security review:
+  - write up security model used in classic tracker
+  - ensure classic template actually implements the model detailed
 
 Optionally:
 - clean up roundup.cgi (switch to config file, use proper logging, remove