some security spaghetti code:(