I'm not completely sure if this is supposed to be sincere, but it should be.

It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.