Abandoned TODO/FIXME

Detects unresolved TODO, FIXME, HACK, and XXX comments — unfinished work that shipped.

Rule ID:abandoned-todo

Examples#

BadUnresolved TODOs and FIXMEs shipped to production

// TODO: add error handling
async function fetchUser(id: string) {
  const res = await fetch(`/api/users/${id}`);
  return res.json();
}

// FIXME: this breaks with special characters
function sanitize(input: string) {
  return input.replace(/[<>]/g, '');
}

// HACK: temporary workaround for auth bug
const token = localStorage.getItem('token') || 'default';

// XXX: need to refactor this entire module
export function processPayment() { /* ... */ }

GoodImplement or create tickets

// Implemented — no TODO needed
async function fetchUser(id: string) {
  try {
    const res = await fetch(`/api/users/${id}`);
    if (!res.ok) throw new ApiError(res.status);
    return res.json();
  } catch (error) {
    logger.error('fetchUser failed', { id, error });
    throw error;
  }
}

// Fixed — handles special characters properly
function sanitize(input: string) {
  return DOMPurify.sanitize(input);
}

// If you can't fix it now, create a ticket:
// Tracked in JIRA-1234: Refactor payment module

What It Detects#

mediumFIXME/HACK/XXX keyword in code

Unresolved {KEYWORD}: "{comment}"

Fix: Implement the missing functionality or create a ticket to track it.

mediumTODO with context

Unresolved TODO: "{comment}"

Fix: Implement or create a ticket. TODOs are tech debt.

Exclusions#

The following are automatically excluded from this rule:

Test files
JSDoc block comments

Configuration#

This rule is enabled by default. To disable it:

.vibertestrc.jsonjson

{
  "rules": {
    "abandoned-todo": {
      "enabled": false
    }
  }
}

Learn more: refactoring.guru/smells/comments

#017 AI Smell #019 Security Anti-Patterns