fix security bug