fixed domains and package name in security