diff --git a/src/backend/core/api/viewsets.py b/src/backend/core/api/viewsets.py
index 9ee02528..bae5442f 100644
--- a/src/backend/core/api/viewsets.py
+++ b/src/backend/core/api/viewsets.py
@@ -210,6 +210,10 @@ class RoomViewSet(
         Allow unregistered rooms when activated.
         For unregistered rooms we only return a null id and the livekit room and token.
         """
+
+        # todo - determine whether encryption is needed store a shared secret in memory or in redis
+        # todo - check if a secret already exists, else create one.
+
         try:
             instance = self.get_object()
         except Http404:
@@ -343,6 +347,8 @@ class RoomViewSet(
             {"message": f"Recording stopped for room {room.slug}."}
         )
 
+    # todo - support a callback endpoint when a room is finished, to invalidate cached key
+
 
 class ResourceAccessListModelMixin:
     """List mixin for resource access API."""