smaller improvements in docs

Author: st0ffregen

documentation/README.md

@@ -122,8 +122,8 @@ This vulnerability exists in the custom authentication handshake, that is perfor
 to obtain a special JWT that acts as authentication for MCP (Model Context Protocol) requests.
 
 ### Vulnerability
-The service implements a challenge-response authentication computing first a session key from the shared secret (the created access token), client and server challenge
-and later on using AES CFB8 encryption to generate client credentials from an all-zero IV and client credentials with the session key as key.
+The service implements a challenge-response authentication computing first a session key from the shared secret (the created AI-agent access token), client and server challenge
+and later on using AES CFB8 encryption to generate client credentials from an **all-zero** IV and client credentials with the session key as key.
 Because the server challenge is randomly generated, the resulting session key is also effectively random and is then used to encrypt the IV and the client challenge. 
 In 1 out of 256 cases, the AES-encrypted ciphertext starts with a zero byte, which is XOR´ed with the first byte of the client challenge. 
 If the client challenge is set to all zero, the result will also be a zero byte. In the next encryption round, the AES input is shifted to