Added comment calling out intentional vulnerability