use readonly url for safeexec submodule