Fix security hole

You need to fix this.