diff --git a/devdocs/todo.txt b/devdocs/todo.txt
index 29a587fe..357e992d 100644
--- a/devdocs/todo.txt
+++ b/devdocs/todo.txt
@@ -15,6 +15,9 @@ REALLY MAKING MORE PROGRESS WHEN CLIENT DEV DRIVES BACKEND DEV, STICK TO THAT!!
 
 DO CLIENT STUFF NOW COME BACK TO THIS STUFF LATER
 
+TODO: Tag list search route needs a hard limit, right now it could return infinite results, should be hard capped at a sane level, particularly in event of single letter searches
+	- Maybe no more than 100 results at a time or whatever is practical at the client end
+	- Make sure it limits by sql query, not by post processing results otherwise it's only solving half the problem
 ###*** BEFORE NEXT UPDATE TO DEVOPS SERVER:::::::
 TODO: 2019-06-07 10:47:57.8894|WARN|Microsoft.AspNetCore.Cors.Infrastructure.CorsService|The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the policy by listing individual origins if credentials needs to be supported.
 2