fixed security bug with picking digits in reverse order