prevent private key exposed