fix security bug.