Anyone able to fix this security loophole?