diff --git a/project_amber/controllers/auth.py b/project_amber/controllers/auth.py
index c3db5c6..ec114de 100644
--- a/project_amber/controllers/auth.py
+++ b/project_amber/controllers/auth.py
@@ -37,7 +37,7 @@ def gen_token() -> str:
 
 
 class UserController:
-    user: LoginUser = None
+    user: LoginUser
 
     def __init__(self, user: LoginUser):
         self.user = user
diff --git a/project_amber/controllers/task.py b/project_amber/controllers/task.py
index 53b0728..bdc478b 100644
--- a/project_amber/controllers/task.py
+++ b/project_amber/controllers/task.py
@@ -1,4 +1,4 @@
-from typing import List
+from typing import List, Optional, cast
 
 from project_amber.const import MSG_TASK_NOT_FOUND, MSG_TASK_DANGEROUS, \
     MSG_TEXT_NOT_SPECIFIED
@@ -10,7 +10,7 @@
 
 
 class TaskController:
-    user: LoginUser = None
+    user: LoginUser
 
     def __init__(self, user: LoginUser):
         self.user = user
diff --git a/project_amber/models/task.py b/project_amber/models/task.py
index e671306..5fb49b6 100644
--- a/project_amber/models/task.py
+++ b/project_amber/models/task.py
@@ -53,6 +53,8 @@ def merge(self, task: "Task"):
 
     def __init__(self, owner: int, data: dict = None):
         # TODO: should't throw HTTP errors from model code
+        # TODO: ideally this dictionary should be a TypedDict; we've bumped our
+        # Python requirements to 3.8 already
         if not isinstance(data, dict): raise BadRequest
         self.text = data.get(API_TEXT)
         self.status = data.get(API_STATUS)