doc, security flaw fix