secure validation whitelist practice