fix security issue (thank to sohelzerdoumi for reporting it)