Tucan security issue unfixed