this is far fetched, but someone with malicious intent could inject a peace of code within the zap comment, and the code will activate and returns back the valuable info from the receiver end.