working before security testing