hooksecurefunc rules but still broken