work on setting security, not finish