I think it is the responsibility of the caller to sanitise the max_points coming from the client. I will implement it in this pull request.