Fix security issue, add rspec