note the security events API in CHANGES