diff --git a/manifest.json b/manifest.json
index 649e5bc4..27a11ef4 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "name": "Old Twitter Layout (2024)",
   "description": "__MSG_ext_description__",
-  "version": "1.8.9",
+  "version": "1.8.9.1",
   "manifest_version": 3,
   "homepage_url": "https://github.com/dimdenGD/OldTwitter",
   "background": {
diff --git a/sandbox.html b/sandbox.html
index c31b36a4..aa464339 100644
--- a/sandbox.html
+++ b/sandbox.html
@@ -8,7 +8,6 @@
 </head>
 <body>
     <div id="anims" style="display:none"></div>
-    <!-- Don't forget to change SHA hash in CSP when changing this script -->
     <script>
         function sleep(ms) {
             return new Promise(resolve => setTimeout(resolve, ms));
@@ -59,6 +58,7 @@
                     // It only ever executes code from trusted Twitter domain, abs.twimg.com (specifically their script that generates security headers)
                     // It's impossible to have it contained in extension itself, since it's generated dynamically
                     // you can see where script is loaded in scripts/twchallenge.js
+                    // it also can't use any extension APIs, since it's contained in object url iframe
                     eval(challengeData.replace(headerRegex, '$1:$2=>{window._CHALLENGE=()=>$3;'));
                     let id = headerMatch[1];
                     webpackChunk_twitter_responsive_web[0][1][id]();
