Fix security issues: validate input and URLs