fix security issue. what was I thinking?