JS security fix