basic comments with validation, no security, not manageable