update TODO

diff --git a/TODO b/TODO
index 88b4ed34d7a1e0763dbd1f2838e0e47e1685beb2..a99f2c99dd4cbf527f204523fd00bd68fc5bbc7b 100644 (file)
--- a/TODO
+++ b/TODO
@@ -117,6 +117,8 @@ Deprecations and removals:
 
 Features:
 
+* bootctl: warn if ESP is mounted world-readable (and in particular the seed)
+
 * maybe: systemd-loop-generator that sets up loopback devices if requested via kernel
   cmdline. usecase: include encrypted/verity root fs in UKI.