security fix: found by @hamb and his friend