I have been keeping notes on what I still have to do for my security work in a Google Doc. I decided it was easier to just publish the document than to try to maintain both notes in the module docstring and this document since no one else is really hacking on the code but me so I don't have to worry about managing editors of the document itself.
At this point I am still working on my import rewrite. I don't have case-insensitive filesystem support or the ImportWarning for when people try to import a directory without an __init__.py file. Otherwise I am now on to trying to get the Python test suite to pass. Most of it is stuff I just didn't think of when writing the code (e.g., having an empty module name be a ValueError but only if 'level' is not above 0).
I am just glad I have a Linux machine at work to use until my laptop gets back from being repaired.