fix security issue      NOT