Security update 1: only read feeds in DB