Im concerned about the large amount of @todo tags that were still in the com_scheduler when it was merged, and now that it is merged, there doesn't seem to be any plan to address these.

This is adding considerable technical debt in a feature that is not even released yet.

@ditsuke

An even scary @joomla/security @todocomment in plugins/task/requests/requests.php

// @todo this handling must be rethought and made safe. stands as a good demo right now.
		$responseFilename = Path::clean(JPATH_ROOT . "/tmp/task_{$id}_response.html");

There are 34 @todo tags in /administrator/components/com_scheduler alone.