security refactor