fix security issues + tests