all functionality seems to work - lightly tested - security vulnerability still exists