buckets/ssl_buckets.c (10 lines):
	- line 676: /* TODO: hard fail vs soft fail */
	- line 689: /* TODO: check certificate status */
	- line 696: /* TODO: try to find which certificate this is about. */
	- line 1419: /* FIXME: return error here */
	- line 1453: /* FIXME: This is lame and not portable. -aaron */
	- line 1529: /* FIXME: error out here */
	- line 1596: /* TODO: this will hang indefintely when the file can't be found. */
	- line 2123: /* TODO: free crl when closing ssl session */
	- line 2725: /* TODO: Support other hash algorithms besides the default SHA1. */
	- line 2738: TODO: see above re hash algorithms. */


protocols/http2_protocol.c (6 lines):
	- line 505: /* ### TODO: Store priority information on stream */
	- line 594: /* ### TODO: Handle error code, etc. */
	- line 794: /* ### TODO: Handle settings */
	- line 968: /* ### TODO: If the error is not critical stop creating new frames
	- line 1682: /* TODO: Teardown connection, reset if necessary, etc. */
	- line 1830: /* TODO: Teardown connection, reset if necessary, etc. */


buckets/bwtp_buckets.c (4 lines):
	- line 44: int type; /* 0 = header, 1 = message */ /* TODO enum? */
	- line 66: int type; /* 0 = header, 1 = message */ /* TODO enum? */
	- line 211: /* TODO Deal with folding.  Yikes. */
	- line 601: serf_default_peek /* ### TODO */,


auth/auth_digest.c (4 lines):
	- line 35: /* TODO: add support for the domain attribute. This defines the protection
	- line 155: /* TODO: auth-int isn't supported! */
	- line 344: TODO: we currently don't cache this info per realm, so each time a request
	- line 421: /* TODO: per request pool? */


src/outgoing.c (3 lines):
	- line 508: TODO: what about a partially written request? */
	- line 608: /* TODO: Handle request done */
	- line 824: /* TODO What about socket errors? */


auth/auth_spnego.c (2 lines):
	- line 39: /** TODO:
	- line 95: * ### TODO: Not implemented yet!


buckets/deflate_buckets.c (2 lines):
	- line 308: /* FIXME: There probably needs to be a free func. */
	- line 327: /* FIXME: There probably needs to be a free func. */


buckets/hpack_buckets.c (2 lines):
	- line 571: /* TODO: Others? */
	- line 666: /* TODO: Handle *_copy by keeping some flags */


serf_private.h (2 lines):
	- line 118: /* TODO: remove before next serf release, FOR TESTING ONLY */
	- line 683: TODO: The serf__authn_info_t objects are allocated in the context pool, so


auth/auth_spnego_gss.c (1 line):
	- line 174: /* TODO: should be shared between multiple requests. */


buckets/chunk_buckets.c (1 line):
	- line 243: /* TODO: status */


src/outgoing_request.c (1 line):
	- line 484: /* TODO: what if a request is partially written? */


buckets/request_buckets.c (1 line):
	- line 433: /* TODO: Determine the body type.. Wrap bucket if necessary,


auth/auth.c (1 line):
	- line 291: /* TODO: the response bucket was created by the application, not at all


src/pump.c (1 line):
	- line 319: /* TODO: now that read_iovec will effectively try to return as much


src/context.c (1 line):
	- line 158: /* ### TODO: As of APR 1.4.x apr_pollset_create_ex can return a status


protocols/fcgi_stream.c (1 line):
	- line 293: /* ### TODO */


protocols/http2_protocol.h (1 line):
	- line 151: /* TODO: Priority, etc. */


auth/auth_basic.c (1 line):
	- line 125: TODO: we currently don't cache this info per realm, so each time a request


buckets/log_wrapper_buckets.c (1 line):
	- line 25: /* TODO: don't use SOCK[_MSG]_VERBOSE directly, but get a log category in


protocols/http2_stream.c (1 line):
	- line 715: /* TODO: Store key+value somewhere to allow asking the application


serf.h (1 line):
	- line 1486: /* TODO: it's not yet possible to define custom layouts */