docroot security fixes