security loopholes