diff --git a/include/sway/security.h b/include/sway/security.h
index fa1dcf177..d6f3df061 100644
--- a/include/sway/security.h
+++ b/include/sway/security.h
@@ -6,6 +6,7 @@
 #include "sway/config.h"
 
 bool load_security(struct wl_display *display);
+void finish_security(void);
 bool check_security_rule(const char *cmd, const char *global);
 
 struct command_policy *alloc_command_policy(const char *command);
diff --git a/sway/main.c b/sway/main.c
index bef5a40fa..df949106b 100644
--- a/sway/main.c
+++ b/sway/main.c
@@ -422,6 +422,8 @@ int main(int argc, char **argv) {
 	root_destroy(root);
 	root = NULL;
 
+	finish_security();
+
 	if (config) {
 		free_config(config);
 	}
diff --git a/sway/security.c b/sway/security.c
index 23af3ebf2..2521b976c 100644
--- a/sway/security.c
+++ b/sway/security.c
@@ -123,6 +123,18 @@ bool load_security(struct wl_display *display) {
 	return true;
 }
 
+void finish_security(void) {
+	struct sway_security_rule *rule, *tmp;
+	wl_list_for_each_safe(rule, tmp, &rules, link) {
+		free(rule->command);
+		free(rule->global);
+		wl_list_remove(&rule->link);
+		free(rule);
+	}
+
+	wl_list_remove(&rules);
+}
+
 bool check_security_rule(const char *cmd, const char *global) {
 	struct sway_security_rule *rule;
 	wl_list_for_each(rule, &rules, link) {