Why is this an issue?

The Security.exactSettings value should remain set at the default value of true. Setting this value to false could make the SWF vulnerable to cross-domain attacks.

Noncompliant code example

Security.exactSettings = false;

Compliant solution

Security.exactSettings = true;