vulnerablity: use None instead of -1 as special value and add some comment.