security fixes for badge