bounds safety in append method