security fix (#1388)