fixed security issue in api