move security config to core