Fixed both security vulnerabilities by adding a condition to ensure nodes are published, and added node_access Tag