## TODO/FIXME comments

**Severity**: `Info`
**ID**: `todo-comment`

Flags `TODO` and `FIXME` markers left in comments, which signal unfinished work or known
bugs that have not been resolved before the code reached production.

### What it does

Scans every line, block, and NatSpec comment in the source file (`//`, `/* */`, `///`, and
`/** */`) and reports comments containing a `TODO` or `FIXME` marker.

A marker is recognized when it appears at the start of a whitespace-delimited token and is
immediately followed by one of `:` `(` `,` `;` `.` `)`. Bare `TODO` and `FIXME` tokens are also
recognized when they are the first meaningful token on a comment line or immediately follow a
NatSpec tag such as `@dev`. A period does not count when followed by an alphanumeric character or
underscore, preventing dotted names such as `todo.md` from matching. Matching is case-insensitive,
so `todo:`, `ToDo:`, and `FixMe:` all match.

### Why is this bad?

`TODO` and `FIXME` comments are development notes. Shipping them into production contracts
signals incomplete work.

### Example

#### Bad

```solidity
contract Vault {
    // TODO: implement access control
    function withdraw() public {}

    // FIXME this check is wrong
    function deposit(uint256 amount) public {
        require(amount > 0);
    }
}
```

#### Good

```solidity
contract Vault {
    function withdraw() public onlyOwner {}

    function deposit(uint256 amount) public {
        require(amount > 0, "zero amount");
    }
}
```