fix security hole in helper