fix #2 security issue with  use