diff --git a/TODO.md b/TODO.md
index ef68315..ca90597 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2,6 +2,9 @@
 
 ## High priority
 
+* aquatic_udp
+  * find out if hmac connection validation solution is actually secure
+
 * aquatic_http_private
   * Consider not setting Content-type: text/plain for responses and send vec as default octet stream instead
   * stored procedure