diff --git a/README.md b/README.md
index 1ac68da..a47fe7d 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,7 @@ tests locally:
 
 ## TODOs
 
+- Implement [CSRF](https://docs.mojolicious.org/Mojolicious/Guides/Rendering#Cross-site-request-forgery)
 - Tripcodes/PGP signing somehow perhaps...
 
 ## AGPL-3.0+ANTIFA compliance