security config fixes