fix security hole