lib/Mail/SpamAssassin/PerMsgStatus.pm (8 lines):
	- line 409: # TODO: change this to do welcomelist/blocklists first? probably a plan
	- line 463: # TODO: document?
	- line 2391: # TODO: silly call to Node module, should probably be in Util
	- line 2414: # TODO: IDN matching needs honing
	- line 2771: # (TODO: why only use for RBLs?? why not uri rules? Use tflags to choose?)
	- line 3040: # TODO: refactor and merge this into that function
	- line 3584: # TODO: 4.0 need :first:addr here ? Why check so many headers ?
	- line 3670: # TODO: 4.0 use :first:addr ? Why so many headers ?


lib/Mail/SpamAssassin/Plugin/Rule2XSBody.pm (5 lines):
	- line 140: # TODO: we should be able to order the 'finish_parsing_end'
	- line 160: # TODO: need a cleaner way to do this.  I expect when rule types
	- line 183: # TODO: issue a warning for low counts?
	- line 184: # TODO: inhibit rule2xs scanning entirely for low counts?
	- line 269: # TODO: hit_rule_plugin_code? it's just debugging really


spamc/spamc.c (4 lines):
	- line 686: /* TODO: leaked.  not a big deal since spamc exits quickly */
	- line 703: /* TODO: leaked.  not a big deal since spamc exits quickly */
	- line 824: /* FIXME: The handling of SPAMC_CHECK_ONLY should probably be moved to
	- line 877: /* TODO: leaked.  not a big deal since spamc exits quickly */


lib/Mail/SpamAssassin/Plugin/BodyRuleBaseExtractor.pm (4 lines):
	- line 67: # TODO: it would be nice to have a clean API to pass such settings
	- line 287: # TODO: there's a bug here.  Since the code in extract_hints() has been
	- line 429: # TODO:
	- line 1020: # TODO: expose this via sa-compile command-line option


spamd-apache2/lib/Mail/SpamAssassin/Spamd.pm (3 lines):
	- line 8: our $SPAMD_VER = '1.4';    # TODO: support for `Compress: zlib'
	- line 366: else {    # FIXME: this should *never* happen, yet it does...
	- line 571: # FIXME: tidy this one, might contain trash


lib/Mail/SpamAssassin/HTML.pm (3 lines):
	- line 528: # TODO: skip if we've already seen body
	- line 855: # TODO: There's still the problem completely foreign unicode strings,
	- line 1169: # TODO: figure out what MUAs actually do with unschemed URIs


lib/Mail/SpamAssassin/Plugin/SPF.pm (3 lines):
	- line 595: # TODO: this will only work if the queries are ready before SPF, so never?
	- line 639: # TODO: we're supposed to use the helo domain as the sender identity (for
	- line 667: # TODO: currently we won't get to here for a mfrom check with a null sender


spamc/libspamc.h (2 lines):
	- line 50: /* FIXME: This stuff has to go somewhere else */
	- line 72: /* FIXME: This doesn't belong here either */


lib/Mail/SpamAssassin/BayesStore.pm (2 lines):
	- line 37: # TODO: if we ever get tuits, it'd be good to make these POD
	- line 99: # TODO: at some stage, this may be useful to read config items which


lib/Mail/SpamAssassin/Plugin/OneLineBodyRuleType.pm (2 lines):
	- line 88: # TODO: we need a better way to define new ruletypes via plugin
	- line 94: # TODO: should have a consttype for plugin-defined "alien" rule types,


lib/Mail/SpamAssassin/Message.pm (2 lines):
	- line 1008: # TODO:
	- line 1014: # TODO: This is duplicate code from few pages down below..


spamd-apache2/lib/Mail/SpamAssassin/Spamd/Apache2.pm (2 lines):
	- line 279: else {    # FIXME: remove
	- line 345: if ($self->spamtest->{'paranoid'}) {  # FIXME: return something? die? whatever?


lib/Mail/SpamAssassin/Conf.pm (2 lines):
	- line 100: # TODO: move to Constants.pm?
	- line 142: # TODO: move to Constants.pm?


lib/Mail/SpamAssassin/Plugin/Bayes.pm (2 lines):
	- line 378: # it.  TODO: callers shouldn't *need* to know it!
	- line 1089: # TODO: these are NOT public, but the test suite needs to call them.


t/SATest.pm (2 lines):
	- line 277: # FIXME: Eventually we can actually test setuid nobody and accessing ./log to make this test more fine grained
	- line 409: # TODO: should we use -p, or modify the test_rules_copy/99_test_default.cf?


lib/Mail/SpamAssassin/BayesStore/DBM.pm (2 lines):
	- line 270: $tout = 300;       # TODO: Dan to write better lock code
	- line 1281: # TODO: use locking here


lib/Mail/SpamAssassin/BayesStore/BDB.pm (1 line):
	- line 1418: FIXME: This is rarely a good interface, because of the churn that will


xt/20_saw_ampersand.t (1 line):
	- line 170: # TODO: unportable


spamc/libspamc.c (1 line):
	- line 1390: /* TODO: free using freeaddrinfo() */


lib/Mail/SpamAssassin/Plugin/DCC.pm (1 line):
	- line 1291: if ($raw_x_dcc ne '') { #TODO check if working


t/config_errs.t (1 line):
	- line 5: # TODO: Now we're using Test::More, we could choose to make the failing tests TODO tests so we know if they start passing.


lib/Mail/SpamAssassin/Plugin/Check.pm (1 line):
	- line 225: # TODO No idea yet what would be the most logical place to do all these..


lib/Mail/SpamAssassin/Conf/Parser.pm (1 line):
	- line 364: # TODO: if/else/else won't get flagged here :(


lib/Mail/SpamAssassin/Plugin/Razor2.pm (1 line):
	- line 463: # TODO: check for cache header, set results appropriately


lib/Mail/SpamAssassin/Message/Metadata/Received.pm (1 line):
	- line 827: # TODO: is $1 helo?


lib/Mail/SpamAssassin/AICache.pm (1 line):
	- line 184: # TODO: should we delete it/clean it up?


masses/plugins/HitFreqsRuleTiming.pm (1 line):
	- line 69: # TODO: record all runs and compute std dev


lib/Mail/SpamAssassin/DnsResolver.pm (1 line):
	- line 34: # TODO: caching in this layer instead of in callers.


lib/Mail/SpamAssassin/Plugin/RelayEval.pm (1 line):
	- line 314: # interface (freshmeat newsletter does this).  TODO: this


lib/Mail/SpamAssassin/Locker/Win32.pm (1 line):
	- line 64: # TODO: $self->jittery_one_second_sleep();?


t/trust_path.t (1 line):
	- line 309: # included it (TODO: it is currently not a lint error, netset just warns about it)


lib/Mail/SpamAssassin/Plugin/MIMEHeader.pm (1 line):
	- line 159: # TODO: we should have a more elegant way for new rule types to


lib/Mail/SpamAssassin/Plugin/URIDetail.pm (1 line):
	- line 18: # TODO: where are the tests?


lib/Mail/SpamAssassin/Plugin/WLBLEval.pm (1 line):
	- line 162: # TODO: this should be moved to a utility module off PerMsgStatus,


lib/Mail/SpamAssassin/Dns.pm (1 line):
	- line 225: # TODO: there are some CNAME returns that might be useful


t/re_base_extraction.t (1 line):
	- line 243: # TODO: it would be great if these were correctly recognised as non-lossy


t/spamd_maxsize.t (1 line):
	- line 7: # (was: TODO JMD remove once DB_File bug is fixed)


lib/Mail/SpamAssassin/DBBasedAddrList.pm (1 line):
	- line 116: # TODO: untrap signals to unlock the db file here


spamd-apache2/lib/Mail/SpamAssassin/Spamd/Apache2/AclIP.pm (1 line):
	- line 59: # TODO: log it somewhere (or not?) -- means all denied


lib/Mail/SpamAssassin.pm (1 line):
	- line 1921: # TODO -- open DNS cache etc. if necessary


lib/Mail/SpamAssassin/Plugin/TxRep.pm (1 line):
	- line 1767: # TODO: add an a method to the handler class instead


t/rule_types.t (1 line):
	- line 26: # different rule types we support, header-name macros etc. (TODO: all ;)


lib/Mail/SpamAssassin/Plugin/P595Body.pm (1 line):
	- line 89: # TODO: need a cleaner way to do this.  I expect when rule types


lib/Mail/SpamAssassin/Plugin/DNSEval.pm (1 line):
	- line 173: # Very hacky stuff and direct rbl_evals usage for now, TODO rewrite everything


t/header_utf8.t (1 line):
	- line 22: plan skip_all => "Test requires Perl 5.8" unless $] > 5.008; # TODO: SA already doesn't support anything below 5.8.1


lib/Mail/SpamAssassin/Locker/UnixNFSSafe.pm (1 line):
	- line 233: # TODO: in NFS, it definitely may be one :(


t/cross_user_config_leak.t (1 line):
	- line 10: # TODO: we could also do this by having a boolean attribute on the command


t/spamd_client.t (1 line):
	- line 14: # TODO: These should be skips down in the code, not changing the test count.


lib/Mail/SpamAssassin/Constants.pm (1 line):
	- line 87: #     TODO: Unique Local Unicast Addresses fc00::/7 (RFC 4193)


lib/Mail/SpamAssassin/GeoDB.pm (1 line):
	- line 889: # TODO: use SA internal dns synchronously?