security logic corrected