diff --git a/src/github.com/matrix-org/dendrite/syncapi/sync/requestpool.go b/src/github.com/matrix-org/dendrite/syncapi/sync/requestpool.go
index 56880309f..1067c98b1 100644
--- a/src/github.com/matrix-org/dendrite/syncapi/sync/requestpool.go
+++ b/src/github.com/matrix-org/dendrite/syncapi/sync/requestpool.go
@@ -120,6 +120,9 @@ type stateEventInStateResp struct {
 // is publicly visible. Current behaviour is returning an empty array if the
 // user cannot see the room's history.
 func (rp *RequestPool) OnIncomingStateRequest(req *http.Request, roomID string) util.JSONResponse {
+	// TODO(#287): Auth request and handle the case where the user has left (where
+	// we should return the state at the poin they left)
+
 	stateEvents, err := rp.db.GetStateEventsForRoom(req.Context(), roomID)
 	if err != nil {
 		return httputil.LogThenError(req, err)
@@ -161,6 +164,9 @@ func (rp *RequestPool) OnIncomingStateRequest(req *http.Request, roomID string)
 // state to see if there is an event with that type and state key, if there
 // is then (by default) we return the content, otherwise a 404.
 func (rp *RequestPool) OnIncomingStateTypeRequest(req *http.Request, roomID string, evType, stateKey string) util.JSONResponse {
+	// TODO(#287): Auth request and handle the case where the user has left (where
+	// we should return the state at the poin they left)
+
 	logger := util.GetLogger(req.Context())
 	logger.WithFields(log.Fields{
 		"roomID":   roomID,