diff --git a/todo.md b/todo.md
index e793417..486f622 100644
--- a/todo.md
+++ b/todo.md
@@ -1,6 +1,7 @@
 Interesting issues will get a unique ID with
 `dd if=/dev/urandom bs=5 count=1 | base32`
 
+- Don't leak request ID in audit log
 - Fix long-running downloads restarting in the middle
 - [DMX6CO4G](issues/2021-01Jan/status-DMX6CO4G.md) fire-and-forget logs / key-value status data
 - ptth_tail