fix security regression