security audit - passing