not announced security bug fixed silently

thanks to @cjshmyr