diff --git a/README.md b/README.md
index 85055b3..b7dd423 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,8 @@
 
 ## Todos
 
+- gate the actual account lock/email/deletion behind an environment variable
+  for easy testing and to limit bad surprises
 - discuss the current design choices for when locking the account/sending a
   notification email fails.
   (Current behavior is to periodically retry, avoid deleting if the account