full rewrite for more secure deployment