Adding a comments field to database with flask/SQLAlchemy?

Rather then an association table, you really need an association object. Here's a working example.

from flask import Flask
from flask.ext.sqlalchemy import SQLAlchemy

app = Flask(__name__)
app.secret_key = 'MOO.'
app.config["SQLALCHEMY_DATABASE_URI"] = 'sqlite://'  # In memory.
db = SQLAlchemy(app)


class User(db.Model):
    __tablename__ = 'user'
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String)

    def __repr__(self):
        return '<User {}>'.format(self.name)

class Suspect(db.Model):
    __tablename__ = 'suspect'
    id = db.Column(db.Integer, primary_key=True)
    steam_name = db.Column(db.String)

    def __repr__(self):
        return '<Suspect {}>'.format(self.steam_name)

class List(db.Model):
    __tablename__ = 'list'
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String())
    user_id = db.Column(db.Integer, db.ForeignKey('user.id'))
    user = db.relationship('User', backref=db.backref('lists'))
    suspects = db.relationship('SuspectList', backref='list')
    def __repr__(self):
        return '<List {}>'.format(self.name)


class SuspectList(db.Model):
    __tablename__ = 'suspect_list'
    list_id = db.Column(db.Integer, db.ForeignKey('list.id'), primary_key=True)
    suspect_id = db.Column(db.Integer, db.ForeignKey('suspect.id'), primary_key=True)
    comment = db.Column(db.String)
    suspect = db.relationship('Suspect', backref=db.backref("suspect_list"))

    def __repr__(self):
        return '<SL: %s %s %s>' % (self.list, self.suspect, self.comment)

if __name__ == '__main__':
    with app.app_context():
        db.create_all()
        hacker = Suspect(steam_name='Bob')
        cracker = Suspect(steam_name='Alice')
        carol = User(name='Carol')
        carols_list = List(name='Carols', user=carol)

        hacker_suspect = SuspectList(suspect=hacker, comment='RED HAIR')
        cracker_suspect = SuspectList(suspect=cracker, comment='RED EYES')

        carols_list.suspects.append(hacker_suspect)
        carols_list.suspects.append(cracker_suspect)

        db.session.add(carols_list)  # Trust SQLAlchemy to add all related.
        db.session.commit()

        ## Querying:

        my_list = List.query.filter(User.name == 'Carol').first()
        for record in my_list.suspects:
            print '{} reported {} with comment {}'.format(
                record.list.user.name,
                record.suspect.steam_name,
                record.comment
            )

        # Carol reported Bob with comment RED HAIR
        # Carol reported Alice with comment RED EYES

Two side-notes-- I found it a bit ugly to be use List as a class name, because when you want to query it, your default name would be list = List.query.fi.... which is a bit of a no-go :). Also, what program did you use to generate your ERD?