search with huge security hole