fix security holes