fix possible security hole