Security fixes

@jone pls take a look