add comment about security issue