Halp
Comments are stored and rendered to anyone who opens the ticket. Also: the id is a direct object reference with no ownership check.