source/websocket.c (12 lines):
	- line 24: /* TODO: echo payload of peer CLOSE */
	- line 26: /* TODO: Can we be sure socket will always mark aws_io_messages as complete? */
	- line 28: /* TODO: If something goes wrong during normal shutdown, do I change the error_code? */
	- line 30: /* TODO: Delayed payload works by sending 0-size io_msgs down pipe and trying again when they're compele.
	- line 33: /* TODO: don't fire send completion until data written to socket .. which also means delaying on_shutdown cb */
	- line 35: /* TODO: stop using the HTTP_PARSE error, give websocket its own error */
	- line 241: /* TODO: validate options */
	- line 642: /* TODO: faster source of random (but still seeded by device_random) */
	- line 863: /* TODO: mqtt handler needs to clean up messsages that fail to send. */
	- line 1053: /* TODO: aws_channel_shutdown() should let users specify error_code and "immediate" as separate parameters.
	- line 1464: /* TODO: auto-close if there's a channel-handler to the right */
	- line 1467: /* TODO: auto-respond to PING with PONG */


source/hpack.c (7 lines):
	- line 16: /* #TODO split hpack encoder/decoder into different types */
	- line 18: /* #TODO test empty strings */
	- line 330: /* #TODO Rewrite to be based on octet-size instead of list-size */
	- line 661: /* #TODO handle this. It's not an error. It should simply result in an empty table RFC-7541 4.4 */
	- line 699: /* TODO:: We can optimize this with ring buffer. */
	- line 1026: /* #TODO Validate any padding bits left over in final byte of string.
	- line 1030: /* #TODO impose limits on string length */


source/h2_decoder.c (6 lines):
	- line 1195: /* #TODO RFC-7540 8.1.2.3 & 8.3 Validate request has correct pseudoheaders. Note different rules for CONNECT */
	- line 1196: /* #TODO validate pseudoheader values. each one has its own special rules */
	- line 1322: /* #TODO Validate characters used in header_field->value */
	- line 1343: /* TODO: Validate connection-specific header field (RFC7540 8.1.2.2) */
	- line 1503: /* #TODO Enforces dynamic table resize rules from RFC-7541 4.2
	- line 1507: /* #TODO The TE header field ... MUST NOT contain any value other than "trailers" */


source/request_response.c (4 lines):
	- line 144: /* TODO: instead if checking the last header, maybe we can add the pseudo headers to the end of the existing
	- line 877: * TODO: as we support prior knowledge, we may also want to support http?
	- line 946: /* TODO: handle connection-specific header field (RFC7540 8.1.2.2) */
	- line 961: /* TODO: Refcount the input stream of old message */


include/aws/http/websocket.h (3 lines):
	- line 13: /* TODO: Document lifetime stuff */
	- line 14: /* TODO: Document CLOSE frame behavior (when auto-sent during close, when auto-closed) */
	- line 15: /* TODO: Document auto-pong behavior */


source/websocket_encoder.c (3 lines):
	- line 8: /* TODO: encoder logging */
	- line 9: /* TODO: implement masking function in aws-c-common */
	- line 10: /* TODO: use nospec advance? */


source/websocket_decoder.c (3 lines):
	- line 8: /* TODO: decoder logging */
	- line 260: /* TODO: validate utf-8 */
	- line 261: /* TODO: validate payload of CLOSE frame */


source/websocket_bootstrap.c (2 lines):
	- line 193: /* TODO: websockets has issues if back-pressure is disabled on the whole channel. This should be fixed. */
	- line 483: /* TODO: validate Sec-WebSocket-Accept header */


source/proxy_strategy.c (2 lines):
	- line 709: /* TODO: process vanilla CONNECT response headers here to improve usage/application */
	- line 720: /* TODO: process status code of vanilla CONNECT request here to improve usage/application */


include/aws/http/private/request_response_impl.h (2 lines):
	- line 72: * TODO: (Maybe more, connection-specific header will be removed, etc...)
	- line 73: * TODO: REFCOUNT INPUT_STREAMS!!! And make it public.


source/h1_connection.c (2 lines):
	- line 1742: * TODO: Let the decoder know about stream-window size so it can stop itself,
	- line 1962: /* TODO: Need update the way we calculate statistics, to account for user-controlled pauses.


source/h2_connection.c (2 lines):
	- line 2020: /* #TODO: http/2-ify the request (ex: add ":method" header). Should we mutate a copy or the original? Validate?
	- line 2051: AWS_H2_STREAM_LOG(DEBUG, stream, "Created HTTP/2 request stream"); /* #TODO: print method & path */


source/strutil.c (1 line):
	- line 208: /* TODO: Actually check the complete grammar as defined in RFC7230 5.3 and


include/aws/http/private/random_access_set.h (1 line):
	- line 13: /* TODO: someday, if you want to use it from other repo, move it to aws-c-common. */


source/proxy_connection.c (1 line):
	- line 552: context->original_user_data); /* TODO: support http2 options */


include/aws/http/private/h1_stream.h (1 line):
	- line 59: /* TODO: move most other members in here */


source/h1_decoder.c (1 line):
	- line 560: /* TODO: deal with body of indeterminate length, marking it as successful when connection is closed:


source/h2_stream.c (1 line):
	- line 767: /* #TODO: callback errors should be Stream Errors, not Connection Errors */


include/aws/http/private/h1_connection.h (1 line):
	- line 176: /* TODO: introduce naming conventions for private header functions */


include/aws/http/private/strutil.h (1 line):
	- line 70: * TODO: Actually check the complete grammar as defined in RFC7230 5.3 and


include/aws/http/private/h2_stream.h (1 line):
	- line 100: * TODO: remove this once we have input stream refcounted


source/connection.c (1 line):
	- line 441: /* TODO: expose http1/2 options to server API */