# TODO/FIXME comments

**Severity**: `Info`
**ID**: `todo-comment`

Flags `TODO` and `FIXME` markers left in comments, which signal unfinished work or known
bugs that have not been resolved before the code reached production.

## What it does

Scans every line, block, and NatSpec comment in the source file (`//`, `/* */`, `///`, and
`/** */`) and reports comments containing a `TODO` or `FIXME` marker.

A marker is recognized when it appears at the start of a whitespace-delimited token and is
immediately followed by one of `:` `(` `,` `;` `.` `)`. Bare `TODO` and `FIXME` tokens are also
recognized when they are the first meaningful token on a comment line or immediately follow a
NatSpec tag such as `@dev`. A period does not count when followed by an alphanumeric character or
underscore, preventing dotted names such as `todo.md` from matching. Matching is case-insensitive,
so `todo:`, `ToDo:`, and `FixMe:` all match.

## Why is this bad?

`TODO` and `FIXME` comments are development notes. Shipping them into production contracts
signals incomplete work.

## Example

### Bad

```solidity
contract Vault {
    // TODO: implement access control
    function withdraw() public {}

    // FIXME: this check is wrong
    function deposit(uint256 amount) public {
        require(amount > 0);
    }
}
```

### Good

```solidity
contract Vault {
    function withdraw() public onlyOwner {}

    function deposit(uint256 amount) public {
        require(amount > 0, "zero amount");
    }
}
```
