extend allow when insecure package is installed