From 2183d37d327fcc887286bb6a8e99bde200535b92 Mon Sep 17 00:00:00 2001
From: Alessandro Ros <aler9.dev@gmail.com>
Date: Thu, 23 Jul 2026 22:59:23 +0200
Subject: [PATCH] add comment to prevent security scan false positives (#5973)

---
 internal/protocols/webrtc/inbound_track.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/internal/protocols/webrtc/inbound_track.go b/internal/protocols/webrtc/inbound_track.go
index e6ae29d6..f44b8210 100644
--- a/internal/protocols/webrtc/inbound_track.go
+++ b/internal/protocols/webrtc/inbound_track.go
@@ -334,6 +334,9 @@ func (t *InboundTrack) start() {
 
 			pkts, err2 := rtcp.Unmarshal(buf[:n])
 			if err2 != nil {
+				// it's currently impossible for this to be triggered,
+				// because malformed RTCP packets are already blocked by pion/interceptor
+				// and in particular by the NACK interceptor.
 				panic(err2)
 			}