SECURITY: local path discovery fix