fix: add security on update