Update, security issue, short workaround, should probably not allow autodownloading