added security rules for real app structure