Security enhancements

fix some potential hole