pass over untrusted thid-party lib app