security already requires config in its manifest