Add ToDo of missing implementations

README.md

@@ -344,6 +344,49 @@ Contributions are welcome! Please feel free to submit a Pull Request.
 
 MIT
 
+## TODO: Missing Features
+
+The following features are documented in `docs/IOR_RESOLVER.md` but not yet implemented in the codebase:
+
+### High Priority
+- [ ] **Authentication for Private Repositories**
+  - [ ] GitHub authentication via `GITHUB_TOKEN` environment variable
+  - [ ] Gitea authentication with instance-specific tokens
+  - [ ] Add Authorization headers to fetch requests
+  - *Impact: Currently cannot access private repositories*
+
+- [ ] **Error Recovery & Resilience**
+  - [ ] Implement retry logic with exponential backoff for network failures
+  - [ ] Add `IORResolutionError` class for better error categorization
+  - [ ] Implement fallback strategies for failed fetches
+  - *Impact: Single network failures cause immediate errors*
+
+### Medium Priority
+- [ ] **Security Enhancements**
+  - [ ] HTTPS certificate validation for Git sources
+  - [ ] Content sanitization and pattern scanning
+  - [ ] Component signature verification
+  - [ ] Sandboxing options with configurable restrictions:
+    - Allowed protocols whitelist
+    - Allowed domains whitelist
+    - Maximum component size limits
+  - *Impact: Limited security validation of fetched components*
+
+### Low Priority
+- [ ] **Advanced Features**
+  - [ ] Per-source cache TTL configuration
+  - [ ] Component dependency resolution
+  - [ ] Version conflict resolution
+  - [ ] Cross-platform compatibility checks
+  - [ ] Progress reporting for large downloads
+
+### Future Roadmap (from docs)
+- [ ] P2P protocol implementation (libp2p)
+- [ ] Decentralized component registry
+- [ ] Smart contract integration for Web3
+- [ ] Component marketplace
+- [ ] AI-assisted component discovery
+
 ## Support
 
 For issues and feature requests, please use the [GitHub issue tracker](https://github.com/metatrom/ior-resolver/issues).