prevent vector attack through api callback