fix security weakness