Update notes for submitted changes

* Disable file injection by default