web/security: update for 1.2.8