SECURITY: XSS fix