cvm-securekey-release-app/AttestationUtil.cpp (6 lines):
	- line 8: // TODO: Use OPENSSL_cleanse(buffer, sizeof(buffer)) to clear sensitive data from memory.
	- line 353: // TODO: attestation server URL can be constructed from VM region if necessary.
	- line 460: // TODO: investigate why EVP_PKEY_get_size causes SIGSEGV in OSSL 3.0
	- line 882: // TODO: investiagate why setting padding and md algorithms causing SIGSEGV in OSSL 3.x
	- line 935: // TODO: investiagate why setting padding and md algorithms causing SIGSEGV in OSSL 3.x
	- line 942: if (EVP_PKEY_CTX_set_rsa_oaep_md(ctx, EVP_sha256()) <= 0) // TODO: can be a parameter


client-library/src/Attestation/LinuxTpm/lib/Tss2Wrapper.cpp (2 lines):
	- line 312: // TODO: Log warning: Unexpected count
	- line 328: // TODO: Log version string in error


client-library/src/Attestation/LinuxTpm/lib/Tss2Wrapper.h (2 lines):
	- line 145: //TODO: Move this to Tss2Utils as this function does not use Tpm context in
	- line 156: //TODO: Move this to Tss2Utils as this function does not use Tpm context in


client-library/src/Attestation/AttestationClient/lib/AttestationLibUtils.cpp (2 lines):
	- line 189: // TODO: Replace these static values with values from the an API.
	- line 537: // TODO: There isn't equivalent of EVP_PKEY_CTX_set_rsa_oaep_md for RSA_PKCS1_PADDING


client-library/src/Attestation/LinuxTpm/lib/Tss2Util.cpp (2 lines):
	- line 23: // TODO: Figure out why buffer size 2048 doesn't work
	- line 516: // TODO: Log warning: Unexpected count


client-library/src/Attestation/AttestationClient/lib/AttestationClientImpl.cpp (1 line):
	- line 787: // TODO: Explore having a common json schema between client and service.


client-library/src/Attestation/LinuxTpm/testclient/main.cpp (1 line):
	- line 516: // TODO: populate aik pub and cert with data before running test


azure-protected-vm-secrets/JsonWebToken.cpp (1 line):
	- line 58: // TODO: Validate alg is supported or raise exception


client-library/src/Attestation/LinuxTpm/include/ExceptionUtil.h (1 line):
	- line 165: m_apcaEndpoint(apcaUrlRelative.substr(0, apcaUrlRelative.find('?'))) // Strip off the query parameters. TODO: This is a bit hacky, especially if we need to store the query params in a separate field in the future. Ideally, InvokeHttpsWithRetry should take the relative URL and query params as two separate arguments, and pass them to this constructor separately.


cvm-securekey-release-app/Main.cpp (1 line):
	- line 7: // TODO: Run CodeQL, static analysis on the native code. Also enable it in the repo.