Add security-risk comment