Commented the security flaw with a TODO flag