diff --git a/pkg/ueps/reader.go b/pkg/ueps/reader.go
index 7227ce7..79be96d 100644
--- a/pkg/ueps/reader.go
+++ b/pkg/ueps/reader.go
@@ -87,6 +87,8 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 		case TagHMAC:
 			signature = tagValue
 		default:
+			// Unknown extension tags are included in HMAC coverage to prevent tag-injection attacks.
+			// signedData.Write(extensionTLV) — forward-compatible: new tags are authenticated, not silently dropped.
 			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)