@@ -148,14 +148,13 @@ def as_json(...)
 				private
 
 				# Read the trailer from the connection, and add any headers to the trailer.
-				#
-				# SECURITY: Received trailers are added to the same headers object as the header section and are not marked with `Headers#trailer!`. This is not a smuggling vector: `add(..., trailer: true)` rejects any field whose policy does not permit it as a trailer, so a field such as `content-length` or `host` cannot arrive here, and position in the message does not change what a permitted field means. Marking them would make a buffering proxy re-send them as trailers and drop them from non-chunked responses. Whether the `Generic` fallback policy should permit unknown fields as trailers is tracked in socketry/protocol-http#127.
 				def read_trailer
 					while line = @connection.read_line
 						# Empty line indicates end of trailer:
 						break if line.empty?
 
 						if match = line.match(HEADER)
+							# SECURITY: Received trailers join the same headers object as the header section and are not marked with `trailer!`. This is not a smuggling vector: `trailer: true` rejects any field whose policy does not permit it as a trailer, so a field such as `content-length` or `host` cannot arrive here, and position in the message does not change what a permitted field means. Marking them would make a buffering proxy re-send them as trailers and drop them from non-chunked responses. Whether the `Generic` fallback policy should permit unknown fields as trailers is tracked in socketry/protocol-http#127.
 							@headers.add(match[1], match[2], trailer: true)
 						else
 							raise BadHeader, "Could not parse header: #{line.inspect}"