checkout security bug