security_pass may be null