I use XXX to mean note/attention.
I do so because "NOTE" on it's own does not "scream loudly enough" to me when I read it, and as for "ATTN" I associate that with the writing on a letter when you want to send it to a specific person in an organization.
Here are a couple of examples from my own code:
https://github.com/eriknstr/TEMPer2-getdegs/blob/cfde4306623...
// XXX: Feels a bit stupid to check user_set_iterations each iteration.
// XXX: https://bugs.chromium.org/p/chromium/issues/detail?id=615638
#
# Domain and records to update with the current WAN address of the router
#
# XXX: First record must expose origin server's IP address.
# This is by design because I need to be able to
# log onto my machine remotely using SSH
# so having a DNS name for the IP of the host
# makes more sense than not having it.
#
# If this is not acceptable to you, then this script
# is not suitable for your use-case.
#