fix script injection, api docs