remove insecure package, add permissions on bookmarks