# Emojis being marked as secure **URL:** \ **Category:** Bug\ **Created:** [March 7, 2023, 8:22pm UTC](https://meta.discourse.org/t/emojis-being-marked-as-secure/257425 "2023-03-07T20:22:01Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![martin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/martin/32/491371_2.png) [@martin](https://meta.discourse.org/u/martin)\ **Post date:** [March 9, 2023, 12:28am UTC](https://meta.discourse.org/t/emojis-being-marked-as-secure/257425/3 "2023-03-09T00:28:50Z")
Hey @Wolftallemo , this is kind of a tricky problem when custom emojis (or any publicly accessible upload that may be used in a post) and secure uploads are combined. A while ago we started using an `UploadReference` table to see what is linked to what upload, however when we migrated to this table we set all the `created_at` datetimes to the same thing. The consequence of this is that when we are checking whether the first use of an upload is public or not for security purposes, sometimes the ordering is off and we use the wrong thing, since if both things have the exact same `created_at` then PostgreSQL just does its own thing: > Your mention of this made me re-examine this once more, and I think we can deal with this better by ordering on `created_at ASC` _then_ `id ASC`, so if there are any of these conflicts the real first record should be used. [https://github.com/discourse/discourse/pull/20602](https://github.com/discourse/discourse/pull/20602) If problems persist after this is merged (I will try to get it merged today) and you have uploaded your site, then we can discuss further options, but I do have a suspicion that this is the issue for you. You can confirm it by doing this and comparing results on your site: ```ruby CustomEmoji.find_by(name: "success").upload.upload_references.order("created_at ASC") CustomEmoji.find_by(name: "success").upload.upload_references.order("created_at ASC, id ASC") ``` The first should have a `Post` as the `target_type`, the second should have the `CustomEmoji` as the target type. --- _[View the full topic](https://meta.discourse.org/t/emojis-being-marked-as-secure/257425)._