fixed security issues with settings