bypass permissions risk