diff --git a/README-maintainer b/README-maintainer
index c2967c9..e7f525d 100644
--- a/README-maintainer
+++ b/README-maintainer
@@ -291,9 +291,6 @@ RELEASE PREPARATION
 
 * Check for open fuzz crashes at https://oss-fuzz.com
 
-* Check lgtm: https://lgtm.com/projects/g/qpdf/qpdf/?mode=list for
-  anything worth fixing
-
 * Check all open issues and pull requests in github and the
   sourceforge trackers. See ~/scripts/github-issues. Don't forget pull
   requests. Note: If the location for reporting issues changes, do a
diff --git a/TODO b/TODO
index 5bf49fe..deffddd 100644
--- a/TODO
+++ b/TODO
@@ -58,7 +58,6 @@ Possible future JSON enhancements
 * Consider having warnings be included in the json in a "warnings" key
   in json mode.
 
-
 QPDFJob
 =======
 
@@ -244,7 +243,6 @@ Other notes:
   way that works for the qpdf/qpdf repository as well since they are
   very similar.
 
-
 ABI Changes
 ===========
 
@@ -257,7 +255,6 @@ for "[[deprecated" to find deprecated APIs that can be removed.
   instead of a shared_ptr. There may be other classes that could also
   be converted.
 
-
 Page splitting/merging
 ======================
 
@@ -349,6 +346,8 @@ directory or that are otherwise not publicly accessible. This includes
 things sent to me by email that are specifically not public. Even so,
 I find it useful to make reference to them in this list.
 
+* Consider enabling code scanning on GitHub.
+
 * Add an option --ignore-encryption to ignore encryption information
   and treat encrypted files as if they weren't encrypted. This should
   make it possible to solve #598 (--show-encryption without a