export.py: guard against directory traversal