diff --git a/TODO.txt b/TODO.txt
index 700af0f..676d137 100644
--- a/TODO.txt
+++ b/TODO.txt
@@ -16,6 +16,7 @@ Packaging
 
 Release
 - Improvements: norefer
+- No longer uses cookies (at the expense of a possible reflected-XSS vector)
 - removed ban-evasion support, removed 'get source code' support
 - lost legacy /recent/-no-suffix endpoint, renamed the download-db endpoint (although it's now consistent)
 - conflicts now send you to the homepage, not back to the conflicted article