The code comments asserts that "where option" is vulnerable to sql injection. See: https://github.com/sequelize/sequelize/blob/master/lib/dialects/abstract/query-generator.js#L1125

But as far as I understood where is safe to use from v4 on. So the comment is wrong?!