merge security bug