in documentation, improve security comments