"standardize" the security comments:
1/ when does the possible harmful code fire
2/ how to avoid this to fire
3/ in which case even if that is fired this is harmless