fix gaping security hole