refactoring: rename package handler to security