Fix XSS flaw + change default event type to public