found a potential security issue, but didn't manage to fix it