Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
No, both operands are strings for sure.