fixed fatal security flaw