diff --git a/pkg/ueps/reader.go b/pkg/ueps/reader.go
index 79be96d..6c6faad 100644
--- a/pkg/ueps/reader.go
+++ b/pkg/ueps/reader.go
@@ -87,8 +87,7 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 		case TagHMAC:
 			signature = tagValue
 		default:
-			// Unknown extension tags are included in HMAC coverage to prevent tag-injection attacks.
-			// signedData.Write(extensionTLV) — forward-compatible: new tags are authenticated, not silently dropped.
+			// signedData.WriteByte(unknownTag); signedData.Write(tagValue) — unknown tags contribute to HMAC, blocking injection
 			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)