check for security.members as well