basic security, must be refactored