Hi Thomas, I am not saying it's a security issue, it's just a bug because the code should not throw a NPE in that particular case. Right now, without properly handling of that edge case, the user ends up with a system error on his screen.... So either the attributes need to be validated or cleaned before entering this method or the method should handle null values.