refactor core security-web