Security: /validate ephemeral values