security requires config