diff --git a/TODO.md b/TODO.md
deleted file mode 100644
index 6e156f8..0000000
--- a/TODO.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# TODO
-
-## Response headers don't work with host ACL conditions
-
-`http-response set-header ... if host_X` doesn't work because `hdr(host)` is a request-phase fetch that HAProxy can't evaluate in the response phase. The headers are generated but silently ignored (HAProxy logs a WARNING).
-
-Fix: capture the host in a transaction variable during the request phase, then use it in response rules:
-```haproxy
-http-request set-var(txn.host) hdr(host)
-acl is_keila var(txn.host) -i keila.cloud.payne.io
-http-response set-header Access-Control-Allow-Origin "https://cloud.payne.io" if is_keila
-```
-
-Affects: keila (CORS headers), plausible (Private-Network-Access header).
-
-## Input validation for header values
-
-Header values with special characters (newlines, NULs) should be rejected at registration time. Currently values are Go-`%q`-quoted in the HAProxy output which handles spaces/commas but may produce backslash escapes that HAProxy doesn't understand for edge cases.
-
-## APT package: Authelia bare-metal installation
-
-When building the wild-central apt package in `dist/`, include Authelia as a dependency or document its installation. Bare-metal installation instructions: https://www.authelia.com/integration/deployment/bare-metal/