fixed typo, comments on list create security issue