diff --git a/lib/Server.js b/lib/Server.js
index 56835a9562..a36bec7e35 100644
--- a/lib/Server.js
+++ b/lib/Server.js
@@ -891,6 +891,8 @@ class Server {
         directory: path.join(process.cwd(), "public"),
         staticOptions: {},
         publicPath: ["/"],
+        // TODO in the next major release default to `false`: a listing names
+        // every file in the directory, and `true` should be how one is asked for.
         serveIndex: { icons: true },
         watch: getWatchOptions(),
       });
@@ -2215,6 +2217,11 @@ class Server {
           return;
         }
 
+        // TODO in the next major release also require the per-run hot token
+        // here and on open-editor, once it is handed to every client: both act
+        // on the developer's machine, and `Sec-Fetch-*`/`Origin` are not sent
+        // over plain `http` to anything but `localhost`. The overlay's request
+        // to open-editor has to carry it, from webpack-dev-middleware's client.
         if (!this.#isSameOriginRequest(req)) {
           res.statusCode = 403;
           res.end("Cross-Origin request blocked");
@@ -4300,6 +4307,11 @@ class Server {
    * @returns {Promise<void>}
    */
   async listen() {
+    // TODO in the next major release default `host` to "localhost": with no
+    // `host`, Node listens on every interface, so the server, the sources it
+    // serves and the internal endpoints are reachable from the whole network
+    // by default. Reaching it from another machine should take saying so,
+    // with `host: "0.0.0.0"`, "local-ip" or an address.
     const listenOptions = this.options.ipc
       ? { path: this.options.ipc }
       : { host: this.options.host, port: this.options.port };