improved security rules for step4 code