# Flaw in Tag Event Script when using tag security?

**URL:** <https://forum.inductiveautomation.com/t/flaw-in-tag-event-script-when-using-tag-security/71308>\
**Category:** Ignition\
**Created:** [March 20, 2023, 2:00pm UTC](https://forum.inductiveautomation.com/t/flaw-in-tag-event-script-when-using-tag-security/71308 "2023-03-20T14:00:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tashby](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tashby/32/67562_2.png) [@tashby](https://forum.inductiveautomation.com/u/tashby)\
**Post date:** [March 20, 2023, 2:01pm UTC](https://forum.inductiveautomation.com/t/flaw-in-tag-event-script-when-using-tag-security/71308/1 "2023-03-20T14:01:00Z")

</div>

We have been working on implementing tag security through our projects and noticed when you have an OPC tag with security set properly on it, it works as expected, but only if you attempt to write to it directly.  
However, if you have another tag without tag security set on it write to the first tag via tag event script, you can then basically circumvent that security.

Is it planned to have this addressed?

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 20, 2023, 2:20pm UTC](https://forum.inductiveautomation.com/t/flaw-in-tag-event-script-when-using-tag-security/71308/2 "2023-03-20T14:20:39Z")

</div>

> [@tashby](#):
>
> However, if you have another tag without tag security set on it write to the first tag via tag event script, you can then basically circumvent that security.

This isn't a flaw, as far as I know this is as designed, the user isn't initiating the write to the secured tag, the system is. Tag Change scripts occur outside of the normal client security system.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [March 20, 2023, 2:35pm UTC](https://forum.inductiveautomation.com/t/flaw-in-tag-event-script-when-using-tag-security/71308/3 "2023-03-20T14:35:56Z")

</div>

That's my understanding of the current state as well. However, I believe a revamp to make things more explicit and auditable throughout is also in the works.