fix security: only parent may call