oasp-security: refactoring