5.4.0 security write-ups (asset holders via the API; Files folder delete inside check) and the recycle bin design history