# PR#67: The Result Comment Names the Security Concern of the Model

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## The Problem

PR-Agent answers `security_concerns` with "No" or with a text that describes the concern.
werkrevisor makes any other answer than "No" YELLOW, with the reason "model reports a security concern".
The text of the concern is lost: PR#63 got YELLOW for one, and neither the author nor the reviewer could see what it was.

## Non-Goals

- No change to the verdict: a security concern of the model stays YELLOW.
- No line comment for the concern: PR-Agent gives it no file and no line.

## The Scenarios

### Feature: the reason of a security concern holds its text

#### Scenario#67.01: the reason quotes the concern

So that the reviewer can judge the concern without a new model run.

- **Given** the model answers `security_concerns` with "SQL injection: the query concatenates the user name."
- **When** werkrevisor assesses the answer
- **Then** the verdict is YELLOW
- **And** the reason reads "model reports a security concern: SQL injection: the query concatenates the user name."

##### Verified by

- [test_verdict.ModelMappingTest.test_security_concern_is_yellow_and_quoted](../../tests/test_verdict.py)

#### Scenario#67.02: a long concern is shortened to one line

So that a long answer does not push the other reasons out of view.

- **Given** the model answers `security_concerns` with several lines and more than 400 characters
- **When** werkrevisor assesses the answer
- **Then** the reason holds the concern on one line, cut after 400 characters and marked with "…"

##### Verified by

- [test_verdict.ModelMappingTest.test_a_long_security_concern_is_one_shortened_line](../../tests/test_verdict.py)

## The Solution

- The reason `model_security` quotes the concern on one line, at most 400 characters.
- The README says so; the Werkbaum marks the item as done.
- Version 0.31.1.