fix security rules