move conf.js to repo
update security