security restrictions only in prod