diff --git a/README.md b/README.md
index c103367..92511f2 100644
--- a/README.md
+++ b/README.md
@@ -35,3 +35,6 @@ ssh -nNTvL 5432:fsmi-db.fsmi.org:5432 fsmi-login.fsmi.uni-karlsruhe.de
   - [ ] etc.
   - [ ] Make it print nicely
 - [ ] Make it possible to edit entries
+- [ ] Fix unsafe client-side sessions, either:
+  - [ ] Use `flask-session` for file-backed sessions
+  - [ ] Use `flask-login` with a single user stored in memory