API security bugfix