some security for API #944