fixed security bug