diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1dbbd63..a06f34f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,5 @@
 name: 'CI'
-on:
-  pull_request:
-  push:
+on: [push, pull_request]
 
 env:
   RUST_BACKTRACE: 1
@@ -56,7 +54,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        san: [address, leak]
+        san: ["address,leak"]
         feature: ["", "arbitrary_precision", "sort_keys", "use_raw", "utf8_lossy"]
     name: Sanitize ${{matrix.san}} feature ${{matrix.feature}}
     runs-on: [self-hosted, Linux, amd64]
diff --git a/src/value/node.rs b/src/value/node.rs
index b9a7635..36a5afb 100644
--- a/src/value/node.rs
+++ b/src/value/node.rs
@@ -67,8 +67,19 @@ use crate::{
 ///
 /// # Notes
 ///
-/// Actually the lookup in `Value` is O(n), not O(1). If you want to use `Value` as a map, recommend
-/// to use `serde_json::Value`.
+/// Not use any unsafe invalid_reference_casting for `Value`, it will cause UB.
+///
+/// ```rust,no_run
+/// use sonic_rs::{from_str, Value};
+/// let json = r#"["a", "b", "c"]"#;
+/// let root: Value = from_str(json).unwrap();
+/// let immref = &root["b"];
+///
+/// // This is dangerous, will coredump when using sanitizer
+/// #[allow(invalid_reference_casting)]
+/// let ub_cast = unsafe { &mut *(immref as *const _ as *mut Value) };
+/// let _ub = std::mem::take(ub_cast);
+/// ```
 #[repr(C)]
 pub struct Value {
     pub(crate) meta: Meta,