diff --git a/lib/protocol/http1/body/chunked.rb b/lib/protocol/http1/body/chunked.rb
index 2c8b19e..bce9c4e 100644
--- a/lib/protocol/http1/body/chunked.rb
+++ b/lib/protocol/http1/body/chunked.rb
@@ -154,6 +154,7 @@ def read_trailer
 						break if line.empty?
 						
 						if match = line.match(HEADER)
+							# SECURITY: Trailers join the headers unmarked. This is not a smuggling vector: `trailer: true` admits only fields whose policy permits trailers, and position does not change what those fields mean.
 							@headers.add(match[1], match[2], trailer: true)
 						else
 							raise BadHeader, "Could not parse header: #{line.inspect}"