Added TODO for 'update' security loop hole