security fixes (#1204)