diff --git a/docs/TODO.md b/docs/TODO.md
new file mode 100644
index 0000000..747e2ee
--- /dev/null
+++ b/docs/TODO.md
@@ -0,0 +1,54 @@
+# TODOs
+[ ] → AutoLoader PSR-4
+[ ] → LoadAll Service and Config files that are ON…
+[ ] → AEBootLoader and Generator (Encrypted Features and Fall Backs)
+[ ] → Encrypted Sessions
+[ ] → Kernels
+[ ] → HTTP → Requests, Responce
+[ ] → Middleware
+[ ] → Macros
+[ ] → Routes
+[ ] → Controllers
+[ ] → Models
+[ ] → Views (Twig/Liquid/PHP)
+[ ] → JavaScript/CSS Asset loading
+[ ] → Strings & Random Engine
+[ ] → HTML Document
+[ ] → Main Project Tempates
+[ ] → 404 Pages/Dev/Prod Errors
+[ ] → CLI Detect
+[ ] → Paginator
+[ ] → Safer I/O
+[ ] → End/Open Tag Matching
+[ ] → UUIDv7 for APIs?
+[ ] → Rate Limiting (Cached in JSON)
+[ ] → PHP Mailer / Access Token
+[ ] → Twilio Support
+[ ] → Logger
+[ ] → Error Handler
+[ ] → CSRF Tokens
+[ ] → Password Hashing/Verify
+[ ] → Sane Config/Service file defaults
+[ ] → Sane Folder Structure and Documentation
+[ ] → Default Routes, then load Controllers
+
+## Extras:
+[ ] → LazyCollections, LazyObjects, Money Class
+[ ] → Tests
+[ ] → RSS Feed
+[ ] → Private API for Sensitive Transactions:
+
+## API
+```
+if ($_SERVER['HTTP_REFERER'] != $_SERVER['HTTP_HOST']) {
+    exit("Form may not be used outside of parent site!");
+}
+```
+## Routes and Controllers
+```
+$returned_route = \ch\router::execute();
+if ($returned_route["found"] === false) {
+    $app = new \ch\app();
+    $app->load\controller();
+}
+```