copied from security_transforms with git hash d508c94e31040d7bcafce6c8959fc6a8cc03a590, intentionally chosing to lose file history