diff --git a/program/src/state/buffer.rs b/program/src/state/buffer.rs
index 19da923..72df2eb 100644
--- a/program/src/state/buffer.rs
+++ b/program/src/state/buffer.rs
@@ -9,6 +9,10 @@ use super::{Account, AccountDiscriminator, ZeroableOption, SEED_LEN};
 /// Buffer account header.
 ///
 /// A buffer holds a variable amount of data after its header information.
+//
+// Note: `Buffer` may be loaded directly from account data after only a
+// length check (no owner check). All fields must be valid for any bit
+// pattern.
 #[repr(C)]
 pub struct Buffer {
     /// Account discriminator.
diff --git a/program/src/state/data.rs b/program/src/state/data.rs
index b2918ed..7d51859 100644
--- a/program/src/state/data.rs
+++ b/program/src/state/data.rs
@@ -51,6 +51,10 @@ pub struct UrlData<'a>(pub &'a str);
 ///
 /// External data contains a reference (address) to an external account
 /// and an offset and an optional length to specify the data range.
+//
+// Note: `ExternalData` may be loaded directly from account data after
+// only a length check (no owner check). All fields must be valid for any
+// bit pattern.
 #[repr(C)]
 pub struct ExternalData {
     /// Address of the external account.
diff --git a/program/src/state/header.rs b/program/src/state/header.rs
index 4613b9e..d78b4a7 100644
--- a/program/src/state/header.rs
+++ b/program/src/state/header.rs
@@ -10,6 +10,10 @@ use super::{
 };
 
 /// Metadata account header.
+//
+// Note: `Header` may be loaded directly from account data after only a
+// length check (no owner check). All fields must be valid for any bit
+// pattern.
 #[repr(C)]
 pub struct Header {
     /// Account discriminator.