SECURITY: fix XSS