SECURITY: fix XSS vulnerability