security update, closes #1