fix critical security bug