some model stuff, initial security commit