diff --git a/.codeclimate.yml b/.codeclimate.yml
index 0cefeeb427a..6ec9c4076ce 100644
--- a/.codeclimate.yml
+++ b/.codeclimate.yml
@@ -67,7 +67,7 @@ plugins:
     - '.codeclimate.yml'
     config:
       strings:
-      # Removed TODO from this list, as we want to allow TODOs in the codebase
+      - TODO
       - FIXME
       - HACK
       - BUG
diff --git a/app/controllers/concerns/user_session_context.rb b/app/controllers/concerns/user_session_context.rb
index e7f58b53970..ed40c55796b 100644
--- a/app/controllers/concerns/user_session_context.rb
+++ b/app/controllers/concerns/user_session_context.rb
@@ -5,7 +5,6 @@ def context
     user_session[:context] || DEFAULT_CONTEXT
   end
 
-  # TODO: Figure out better names for this and the method below
   def initial_authentication_context?
     context == DEFAULT_CONTEXT
   end
diff --git a/app/forms/openid_connect_token_form.rb b/app/forms/openid_connect_token_form.rb
index 4d690e2fa13..3afd4f57718 100644
--- a/app/forms/openid_connect_token_form.rb
+++ b/app/forms/openid_connect_token_form.rb
@@ -96,7 +96,6 @@ def validate_client_assertion
                                    sub: client_id, verify_sub: true)
     validate_aud_claim(payload)
   rescue JWT::DecodeError => err
-    # TODO: i18n these JWT gem error messages
     errors.add(:client_assertion, err.message)
   end
 
diff --git a/app/javascript/packs/personal-key-page-controller.js b/app/javascript/packs/personal-key-page-controller.js
index c3122b67f7c..3e0f67e42b5 100644
--- a/app/javascript/packs/personal-key-page-controller.js
+++ b/app/javascript/packs/personal-key-page-controller.js
@@ -24,7 +24,6 @@ const personalKey = scrapePersonalKey();
 
 // The following methods are strictly fallbacks for IE < 11. There is limited
 // support for HTML5 validation attributes in those browsers
-// TODO: Potentially investigate readding client-side JS errors in a robust way
 function setInvalidHTML() {
   if (isInvalidForm) return;
 
diff --git a/app/services/piv_cac_service.rb b/app/services/piv_cac_service.rb
index facd772de2d..6de250dc710 100644
--- a/app/services/piv_cac_service.rb
+++ b/app/services/piv_cac_service.rb
@@ -75,8 +75,6 @@ def decode_request(uri, token)
     end
 
     def authenticate(token)
-      # TODO: make this secret required once we have everything deployed and configured
-      # The piv/cac service side is pending, so this is not critical yet.
       secret = Figaro.env.piv_cac_verify_token_secret
       return '' if secret.blank?
       nonce = SecureRandom.hex(10)
diff --git a/config/application.yml.example b/config/application.yml.example
index 4bdfec88383..e70f73e1576 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -201,10 +201,6 @@ development:
 # These values serve as defaults for all production-like environments, which
 # includes *.identitysandbox.gov and *.login.gov.
 #
-# TODO: remove empty/fake values from this block, which create the misleading
-# impression that these values aren't used. In fact they will be used unless
-# they are overriden by keys with the same name in the application.yml in the
-# app secrets bucket.
 production:
   aamva_cert_enabled: 'true'
   aamva_public_key: # Base64 encoded public key for AAMVA
diff --git a/spec/features/flows/sp_authentication_flows_spec.rb b/spec/features/flows/sp_authentication_flows_spec.rb
index 406395fcdae..2d5f9f66598 100644
--- a/spec/features/flows/sp_authentication_flows_spec.rb
+++ b/spec/features/flows/sp_authentication_flows_spec.rb
@@ -183,10 +183,6 @@
               end
             end
           end
-
-          # context 'when choosing to sign in' do
-          #   TODO: duplicate scenarios from Create Account here
-          # end
         end
 
         context 'when LOA1' do
diff --git a/spec/features/two_factor_authentication/sign_in_spec.rb b/spec/features/two_factor_authentication/sign_in_spec.rb
index 61cf0da6b8a..6d25a053a85 100644
--- a/spec/features/two_factor_authentication/sign_in_spec.rb
+++ b/spec/features/two_factor_authentication/sign_in_spec.rb
@@ -621,7 +621,6 @@ def submit_prefilled_otp_code
     end
   end
 
-  # TODO: readd profile redirect, modal tests
   describe 'signing in when user does not already have personal key' do
     # For example, when migrating users from another DB
     it 'displays personal key and redirects to profile' do
diff --git a/spec/lib/worker_health_checker_spec.rb b/spec/lib/worker_health_checker_spec.rb
index 3c67542ffba..8ed30ec5884 100644
--- a/spec/lib/worker_health_checker_spec.rb
+++ b/spec/lib/worker_health_checker_spec.rb
@@ -12,7 +12,6 @@
   end
 
   def create_sidekiq_queues(*queues)
-    # TODO: find an API to use rather than manually mess with redis?
     Sidekiq.redis do |redis|
       queues.each do |queue|
         redis.sadd('queues', queue)