order in security.yml matters