is this safe? user 0 could be anybody, no?