fix security issue in test