install to vendor dir
fix format security errors