security issues on controller