mention security issue more prominently in changes after verifying that no known implementation is affected