helper: add is_project_name_safe() and is_path_safe()
security: exit when illegal path received