add comment on XSS