security bug fixed