We have a cryptography specialist on board (divVerent), I don't think there's any TODO there.
I really don't know where you should start... The darkplaces engine is written in C but it's a big, meaty piece of code. I personally think QuakeC is friendlier for a start. I also can't think of any engine bug or feature that wouldn't be quite complex to fix/implement.
If you plan on contributing, you'll have to learn the basics of git. I don't know how it works in Windows; perhaps you can ask MirceaKitsune about this, he does his development work in Windows as far as I know. If you like writing, perhaps you could take notes while setting it up, for reference.
The gamecode is stored in a directory called "qcsrc". The products of compilation are three separate binary blobs: menu.dat, progs.dat (SVQC, server-side gamecode) and csprogs.dat (CSQC, client-side gamecode).
Once you get a copy of the code (through git or from a release/autobuild package), maybe you can try to get an understanding of portions of code that might be bugged. Our bug tracker is at
http://dev.xonotic.org/projects/xonotic/issues.
I can't explain everything, that would take too much time. If you have more specific questions, ask them here or in #xonotic on freenode.