backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java

@@ -15,6 +15,7 @@ import org.springframework.web.server.ResponseStatusException;
 
 import lombok.extern.slf4j.Slf4j;
 
+// "Handler" is Spring's @RestControllerAdvice naming convention — not a generic suffix.
 @RestControllerAdvice
 @Slf4j
 public class GlobalExceptionHandler {

backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java

@@ -7,6 +7,7 @@ import org.springframework.security.core.Authentication;
 
 import java.util.UUID;
 
+// Cross-cutting auth helper; no domain home — "Utils" is the correct suffix here.
 public final class SecurityUtils {
 
     private SecurityUtils() {}

frontend/src/lib/activity/ChronikRow.svelte

@@ -159,15 +159,8 @@ const rowHref: string = $derived(
 		</p>
 
 		{#if variant === 'comment'}
-			<!--
-				TODO: the backend does not yet expose a comment body preview on
-				ActivityFeedItemDTO. Render an ellipsis placeholder until it does —
-				duplicating the document title here looks like the comment is
-				quoting itself (Leonie, PR #288 review).
-				SECURITY: once item.commentPreview lands, render via {text}, never
-				{@html}. The backend must truncate and strip tags server-side (Nora,
-				issue #285 comment #3552).
-			-->
+			<!-- TODO(#454): add commentPreview to ActivityFeedItemDTO, then render here -->
+			<!-- SECURITY: render via {text} not {@html} when commentPreview arrives — XSS risk (#285) -->
 			<p
 				data-testid="chronik-comment-preview"
 				class="mt-1 line-clamp-1 font-serif text-sm text-ink-2 italic sm:line-clamp-2"

frontend/src/routes/admin/+layout.server.ts

@@ -26,8 +26,7 @@ export async function load({ fetch, locals }) {
 	const api = createApiClient(fetch);
 	const canManageUsers = hasPerm(user, 'ADMIN_USER');
 
-	// TODO: replace with a dedicated /api/admin/stats endpoint that returns counts only,
-	// so the System page does not load full entity lists it does not render.
+	// TODO(#453): replace with dedicated /api/admin/stats endpoint returning counts only
 	const [usersResult, groupsResult, tagsResult] = await Promise.all([
 		api.GET('/api/users'),
 		api.GET('/api/groups'),