maybe we should actually check security instead of pretending to