Cherry pick security fix (#274) to 2-5-stable
Merge pull request #299 from Shopify/cherry_pick_security_fix_to_2-5-stable

Cherry pick security fix (#274) to 2-5-stable