security design weaknesses