comply with manifest v2 security policy