add comments to the security issues

they are very useful to know why others have ignored a security issue