diff --git a/README.md b/README.md
index 854f1bc..03a9c30 100644
--- a/README.md
+++ b/README.md
@@ -99,20 +99,6 @@ to the database, and dispatches Discord notifications.
 Firebase, communicates with the API via fetch, and renders the address/alert
 management UI.
 
-## TODO
-
-- [ ] Switch frontend package manager from npm to yarn (per repo policy)
-- [ ] Rename `go.mod` module path from `github.com/kjannette/koin-ping` to
-      `sneak.berlin/go/koin-ping` (per repo policy)
-- [ ] Move database migrations to `internal/db/migrations/` and embed them in
-      the binary
-- [ ] Pin all Docker base images by `@sha256` in Dockerfile
-- [ ] Install `golangci-lint` locally and pass `make lint`
-- [ ] Add vitest unit tests for the React frontend
-- [ ] Add a `make db-reset` / `make migrate` target for schema management
-- [ ] Set HTTP server read/write timeouts (currently unbounded)
-- [ ] Replace `log.Printf` calls with structured `log/slog`
-
 ## License
 
 MIT. See [LICENSE](LICENSE).
diff --git a/backend-go/cmd/api/main.go b/backend-go/cmd/api/main.go
index 4106a22..3068a33 100644
--- a/backend-go/cmd/api/main.go
+++ b/backend-go/cmd/api/main.go
@@ -18,9 +18,9 @@ import (
 )
 
 const (
-	// serverReadTimeoutSeconds is the maximum duration to read a request.
+	// max duration to read a request.
 	serverReadTimeoutSeconds = 5
-	// serverWriteTimeoutSeconds is the maximum duration to write a response.
+	// maxiduration to write a response.
 	serverWriteTimeoutSeconds = 10
 )
 
@@ -74,7 +74,7 @@ func main() {
 	mux.Handle("DELETE "+b+"/addresses/{addressId}",
 		middleware.Authenticate(http.HandlerFunc(addressHandler.Remove)))
 
-	// Authenticated routes — alert rules
+	// Authenticated routes for alert rules
 	mux.Handle("POST "+b+"/addresses/{addressId}/alerts",
 		middleware.Authenticate(http.HandlerFunc(alertRuleHandler.Create)))
 	mux.Handle("GET "+b+"/addresses/{addressId}/alerts",