diff --git a/python/ql/src/experimental/Security/CWE-208/TimingAttack.qll b/python/ql/src/experimental/Security/CWE-208/TimingAttack.qll
index 239aeeced9a..4d6e316ff1e 100644
--- a/python/ql/src/experimental/Security/CWE-208/TimingAttack.qll
+++ b/python/ql/src/experimental/Security/CWE-208/TimingAttack.qll
@@ -71,7 +71,7 @@ class SecretSource extends DataFlow::Node {
 
   SecretSource() { secret = this.asExpr() }
 
-  /** Holds if the source of secret was remote user input. */
+  /** Holds if the secret was deliverd by remote user. */
   predicate includesUserInput() {
     exists(UserInputSecretConfig config |
       config.hasFlowTo(DataFlow2::exprNode(secret))