Path security vulnerability

* potentially exposing internal data
* does not allow unauthorized users to write