diff --git a/TODO.md b/TODO.md
index 1bc8239..a2dab7b 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,42 @@
 # TODO.md
 
 ## TODO
+- Add access control before calling this publish-ready for general users.
+  - Current app assumes a trusted LAN/reverse-proxy environment.
+  - Decide between built-in login/API sessions or documented reverse-proxy auth.
+  - Protect job creation, job deletion, backup deletion, and settings updates.
+- Move long-running destructive deletes to background jobs with progress.
+  - Deleting a backup/job currently waits inside the API request while rclone deletes remote objects.
+  - Add delete operation records, progress/error reporting, and UI polling so large job deletes do not hit proxy/browser timeouts.
+- Strengthen remote upload verification.
+  - Current verification checks that the remote object exists.
+  - Also compare remote size from `rclone lsjson` with the local archive size before deleting the local archive.
+  - If supported by the remote, optionally record/check hashes.
+- Add backup history pagination and search.
+  - Current UI/API can grow noisy as backup records accumulate.
+  - Add `limit`, `offset`/cursor, guest filter, state filter, and date range filter.
+- Add a remote/orphan inspection view.
+  - Show remote backup folders/files that are not represented in SQLite.
+  - Show SQLite records whose remote object is missing.
+  - Keep cleanup manual/explicit; do not auto-delete unknown remote objects.
+- Add retention preview/dry-run in the UI.
+  - For each job, show which completed backups would be deleted by the current retention rule.
+  - Useful before changing retention from days to latest or lowering retention values.
+- Add migration regression tests.
+  - Test fresh DB creation.
+  - Test upgrading older schemas.
+  - Test bad stored timezone repair, including `/UTC`.
+- Replace FastAPI `@app.on_event("startup")` with lifespan handling.
+  - Tests currently pass but FastAPI emits deprecation warnings.
+- Add CI/runtime compatibility coverage for supported Python versions.
+  - CI currently validates one Python version.
+  - Add a small matrix for the supported versions used by common Proxmox/Debian installs.
+- Add clearer setup diagnostics.
+  - Surface `pvesh` access errors, missing storage, bad rclone path, missing remote, and remote path test failures separately.
+  - Add a setup “test connection” action before saving completed setup.
+- Add restore/export planning.
+  - Decide whether the app should support downloading remote archives back locally or only manage backup creation/deletion.
+  - If implemented, restore must be explicit and should not auto-overwrite local files.
 
 ## In Progress