remove insecure package
user data visibility by role