[fix] security problems with tags