TODOs and stubs left in finished work
TODOs, stubs and placeholder values left in the change.
Why it matters
Agents sometimes stub the hard part of a task, leave a TODO where a decision was needed, and then summarize the work as complete. The summary is confident and the code compiles, so the gap is easy to miss in review.
A placeholder does not fail the build. It fails at runtime, or worse, it returns a plausible value that is wrong: a refund marked as done that was never sent, or a feature flag that always says yes. The TODO is the cheapest visible sign that what was claimed and what exists are different.
Example
export async function handleRefund(orderId: string) {
const order = await getOrder(orderId);
- return stripe.refunds.create({ payment_intent: order.paymentIntentId });
+ // TODO: call Stripe once the refund policy is settled
+ return { status: "refunded", orderId: order.id };
}
What it detects
- TODO, FIXME, XXX and HACK markers in added code, as comments or in the TODO: form.
- Placeholder phrases: not implemented, NotImplementedError, unimplemented, placeholder or stub inside a comment, placeholder implementation, coming soon, for now paired with replace, and your_api_key_here.
- In test files only the markers and not-implemented forms count. Placeholder as a code word (a React prop, an HTML attribute) is not flagged.
- Data and markup files (JSON, YAML, Markdown, HTML, CSS and similar), prose strings and regex definitions are skipped. All hits are grouped into one finding, rated medium when any is in source code.
What to do when it fires
Open each marker and decide: finish the implementation, or remove the dead path and the claim that it works. If a TODO is a deliberate, tracked follow-up, link the issue in the comment so the next reader knows it is known.