security scoping