make it less insecure by default