post layout was using insecure buttons