setup: security fixes